Hierarchical group key management approach based on linear geometry

ABSTRACT

A hierarchical group key management approach based on linear geometry is disclosed. The approach includes the following steps: step 1, the central controller selects a finite field F, a mapping parameter f and a constant N for use in the group; the central controller selects a N-dimensional private vector for each subgroup; step 2, the central controller selects a mapping parameter r and maps the private vector to a new set of vectors in the vector space; step 3, the central controller selects a subgroup key for each subgroup and constructs n linear systems of equations, and solves the solution of the linear equation systems, that is, the public vector, and the n sets of public vectors form a public vector; the public vector and the mapping parameter r are broadcasted or multicasted by the central controller to all the subgroup controllers; step 4, each subgroup controller solves the confidential vector of its own, and a set of key vectors is obtained by linear transformation of the confidential vector and the public matrix. This invention is simple and flexible, and is effective against brute-force attacks.

FIELD OF THE INVENTION

The present invention relates to a group key management approach in the network security, and in particular to a hierarchical group key management approach based on linear geometry and the theory of orthogonal vectors.

BACKGROUND OF THE INVENTION

With the rapid development of Internet technology and the popularization of multicast, group-oriented applications, such as video conference, network games, and video on demand, etc., play more and more important roles. Secure group communication becomes an important research aspect. The secure group communication with hierarchical access control relates to a group with a series of subgroups having different access permissions, higher level subgroups receive and decrypt the information sent by its descendant subgroups (direct or indirect), but not vice versa. For the hierarchical access control based on cryptography, the higher level subgroups can obtain/derive the communication key of its descendant subgroups directly or indirectly, while the lower level subgroups can not derive the communication keys of its ancestor subgroups.

Normally, hierarchical access control has the following settings: (1) hierarchical relationship can be represented by Directed Acyclic Graph (DAG); (2) a central controller (CC) is used to manage the hierarchical relationship, and calculate and distribute the keys; (3) in the DAG, each node represents a set of users, and each node is called a subgroup; (4) each subgroup has a subgroup controller (SC) for distributing the subgroup key to each subgroup member; (5) between CC and SC, there is a secure channel for secure communication when the initialization of system or a new subgroup joins in the group; (6) in each subgroup, there is a secure key management scheme for implementing the key management in the subgroup.

These days, there are various approaches in the hierarchical access control. The typical schemes include Akl-Taylor scheme, Lin scheme, Sandhu scheme, Chinese Remainder Theorem (CRT) scheme, etc.

The Akl-Taylor scheme is a key directly dependent scheme based on one-way function. The key of a descendant subgroup is generated by the key of its ancestor subgroup via the one-way function, and the ancestor subgroup can calculate the key of its descendant subgroup directly while the descendant subgroup can not select the key of its own. The advantage of this scheme is that all the nodes do not need to memorize the hierarchical structure, and only have to store the key of its own. The disadvantage of this scheme is that the hierarchical structure is static, and a small variation in the structure will result in the update of all the nodes in the hierarchical structure.

There are also other schemes such as Mackinnon scheme, Chick and Tavares scheme and so on, which can be regarded as the improvements to the Akl-Taylor scheme.

The Lin scheme is a key indirectly dependent scheme based on one-way function. The key of a descendant subgroup is independent of the key of its ancestor subgroup, and the ancestor subgroup can derive the key of its descendant subgroup indirectly. The advantage of this scheme is that the descendant subgroups can change the key independently without affecting the key of the other subgroups. The disadvantage of this scheme is that the subgroups have to memorize the entire hierarchical structure, at least all its descendant subgroups. Furthermore, some auxiliary variables for deriving the keys of the descendant subgroups have to be stored.

The Sandhu scheme is based on the tree structure in which each node has a name. The root node of the tree selects a key randomly, and the key of each other node is obtained by encrypting its name with the key of its ancestor subgroup. A subgroup can obtain the keys of its descendant subgroups by encryption, while a descendant subgroup can not calculate the key of its ancestor subgroup. The advantage of this scheme is that each subgroup only needs to store the information of its own, and the change of the level of a subgroup will only affect the key update of its descendant subgroups. The disadvantage of this scheme is that the subgroups have to memorize some group information, and at least the group information of all its descendant subgroups, and it is only adapted for hierarchical model with tree structure.

In the CRT scheme, the hierarchical structure is hidden in a constructed CRT variable by CRT algorithm, and all ancestor subgroups of a subgroup can calculate the key of this subgroup, while this subgroup can not know which subgroups are its ancestor subgroups. The ancestor subgroups do not know the specific path to the subgroup either, and can only calculate its key. This scheme provides good security, but the disadvantage is that the cost to compute the CRT variable is very large, and it grows proportionally as the number of subgroups increases, and thereby the scalability of the scheme is not good enough.

SUMMARY OF THE INVENTION

It is a first object of the present invention to provide a hierarchical group key management approach based on linear geometry, which is constructed based on a theory of polynomial function in a vector space over a finite field. This approach is simple and flexible, and is effectively against brute-force attacks.

It is a second object of the present invention to provide a further hierarchical group key management approach based on linear geometry, which is constructed based on a further theory of polynomial function in a vector space over a finite field. This approach requires small memory, little computation, high security and is effectively against brute-force attacks.

The first object of the present invention is achieved by the following technical solution: A hierarchical group key management approach based on linear geometry, comprises the following steps:

step 1: a central controller CC selects a mapping f and a finite field F for use by the group, and all computations in the group are performed over the finite field F; moreover, a constant N is determined by the central controller to be used as a upper limit of the number of subgroups; the central controller sends the finite field F, the constant N and the mapping f to all subgroup controllers; suppose the group has n subgroups, the central controller assigns a serial number for each subgroup and sends each serial number to each subgroup controller; the central controller selects a N-dimensional private vector randomly for each subgroup, and sends each N-dimensional private vector to each subgroup controller correspondingly via secure channel; the subgroup controllers receive and store the N-dimensional private vectors from the central controller and keep secret, wherein N and n are positive integers, and n≦N;

step 2: the central controller selects a mapping parameter r in the finite field F, and maps the private vectors of all the subgroup controllers into a new set of vectors called confidential vectors by using the mapping f according to the mapping parameter r; if the new set of vectors is linearly dependent, then the mapping parameter is reselected to perform remapping, or return to the step 1 to allow each subgroup controller to reselect a private vector, until the new set of vectors is linearly independent;

step 3: the central controller selects a subgroup key in the finite field F for each subgroup; the central controller constructs n linear systems of equations according to the hierarchy relationship of the subgroups by using the confidential vectors and the subgroup keys, and calculates the unique solutions of the linear systems of equations which are called public vectors; the confidential vectors and the public vectors are subject to the following regulations: (1) the confidential vectors of lower level nodes are orthogonal to the public vectors of higher level nodes, and the inner product is zero; (2) for all the nodes, the inner product of the confidential vector and the public vector of a current node itself is the group key of the current node; (3) if the higher level node is a parent node or ancestor node of the current node, the inner product of the confidential vector of the higher level node and the public vector of the current node is the group key of the current node; the inner product of the confidential vector of the higher level node and the public vector of a descendant node is the group key of the descendant node; (4) the nodes without direct nor indirect ancestor-descendant relationship with respect to each other can not derive the keys of the other, and the inner product of the confidential vector of one node and the public vector of the other node is zero; (5) the key of one node can not be derived by the other node between brother nodes, and the inner product of the confidential vector of one node and the public vector of the other is zero. n sets of public vectors form a public matrix, the public matrix and the mapping parameter r are broadcasted or multicasted by the central controller to all the subgroup controllers via open channel;

step 4: after receiving the public matrix and the mapping parameter, each subgroup controller maps the private vector of its own to a new vector in a vector space according to the mapping parameter, and solves the confidential vector of its own, then a set of key vectors is obtained by the linear transformation of the confidential vector and the public matrix. The subgroup controller can obtain the group key of its own and all its descendant subgroups through the key vector calculated by itself, while it can not calculate the group keys of its parent group and ancestor groups; the subgroup controller distributes the calculated group keys to group members.

Preferably, the step 1 is implemented by the following: the central controller determines a finite field F, a constant N and a mapping f, and sends the finite field F, the constant N and the mapping f to all the subgroup controllers; the central controller assigns a serial number SC_(i) to each subgroup controller, and sends the serial number SC_(i) to each subgroup controller by broadcasting or multicasting; the central controller selects a N-dimensional private vector Z_(i)=(z_(i,1), z_(i,2), . . . , z_(i,N)) randomly for each subgroup V_(i) and sends the private vector to the corresponding subgroup controller SC_(i) via secure channel; each subgroup controller SC_(i) receives and stores the private vector Z_(i)=(z_(i,1), Z_(i,2), . . . , z_(i,N)) and keeps secret;

Preferably, the step 2 is implemented by the following:

the central controller selects a mapping parameter r in the finite field F, and maps the private vectors Z_(i)=(z_(i,1), z_(i,2), . . . , z_(i,N)) of all the subgroups into a new set of vectors called confidential vectors by using the mapping f;

for a subgroup controller with a serial number SC_(i):

x_(i, 1) = f(z_(i, 1)r) x_(i, 2) = f(z_(i, 2)r) … x_(i, n) = f(z_(i, n), r)

then, the central controller obtains a new set of vectors in the finite field F:

X₁ = (x_(1, 1), x_(1, 2), … , x_(1, n)), X₂ = (x_(2, 1), x_(2, 2), … , x_(2, n)), … , X_(n) = (x_(n, 1), x_(n, 2), … , x_(n, n))

the central controller judges whether X₁, X₂, . . . , X_(n) are linearly dependent, and if they are linearly dependent, then proceed to the step 2, or return to the step 1 to allow the subgroup controller to reselect a private vector until the new set of vectors are linearly independent; or else proceed to step 3 (notice that the linearly independent vector X₁, X₂, . . . , X_(n) can be easily obtained since r is a random number);

the step 3 is implemented by the following:

the central controller selects a random number for each subgroup in the finite field F to be used as a key of the subgroup and suppose the selected random numbers are k₁, k₂, . . . , k_(n) wherein k_(i)≠0. For any subgroup V_(i), let P(i) represent the set of all ancestor nodes of the subgroup V_(i). Suppose the public vector A_(i)=(a_(i,1), a_(i,2), . . . , a_(i,n)) is an unknown parameter, then the public vector A_(i) and the confidential vector X_(j) of each subgroup have the following relationship:

$\begin{matrix} {{X_{j} \times A_{i}^{T}} = \left\{ \begin{matrix} {k_{i},} & {{{if}\mspace{14mu} j} = {{i\mspace{14mu} {or}\mspace{14mu} V_{j}} \in {P(i)}}} \\ {0,} & {{{if}\mspace{14mu} V_{j}} \notin {{{P(i)}\mspace{14mu} {and}\mspace{14mu} j} \neq i}} \end{matrix} \right.} & (1) \end{matrix}$

the equation (1) has the following meaning: (1) for any subgroup V_(i), suppose its confidential vector is X_(i), the public vector is A_(i) and the key is k_(i), then X_(i)×A_(i) ^(T)=k_(i); (2) for other subgroups V_(j) (j=1, . . . , n and j≠i), the confidential vector is represented by X_(j), and if V_(j) is the parent node or grandparent node of V_(i), then X_(j)×A_(i) ^(T)=k_(i), while if V_(J) is not the parent node nor grandparent node of V_(i), then X_(j)×A_(i) ^(T)=0;

from the equation (1): suppose X=(X₁, X₂, . . . , X_(n))^(T), K_(i)=(c_(i,1), c_(i,2), . . . , c_(i,n))^(T),

$c_{i,j} = \left\{ \begin{matrix} {k_{i},} & {{{if}\mspace{14mu} j} = {{i\mspace{14mu} {or}\mspace{14mu} V_{j}} \in {P(i)}}} \\ {0,} & {{{{if}\mspace{14mu} V_{j}} \notin {{{P(i)}\mspace{14mu} {and}\mspace{14mu} j} \neq i}},} \end{matrix} \right.$

then the equation (1) is converted into:

X×A _(i) ^(T) =K _(i)  (2)

Let A=(A₁ ^(T), A₂ ^(T), . . . , A_(n) ^(T)), K=(K₁, K₂, . . . , K_(n)), then for all subgroups V_(i):

X×A=K _(i)  (3)

the central controller needs to solve the system of equations (3), and the system of equations (3) has a unique solution since the linear independence of X₁, X₂, . . . , X_(n) in the step 2 guarantees the coefficient matrix determinant |X|≠0, and A is the public matrix solved;

the public matrix A=(A₁ ^(T), A₂ ^(T), . . . , A_(n) ^(T)) and the mapping parameter r are broadcasted or multicasted by the central controller to all the subgroup controllers via open channel;

the step 4 is implemented by the following:

each subgroup controller receives the public matrix A=(A₁ ^(T), A₂ ^(T), . . . , A_(n) ^(T)) and the mapping parameter r, and calculates X_(i)=(x_(i,1), x_(i,2), . . . , x_(i,n)) via the mapping f:

x_(i, 1) = f(z_(i, 1), r) x_(i, 2) = f(z_(i, 2), r) … , x_(i, n) = f(z_(i, n), r)

then calculates:

k _(i) =X _(i) ×A _(i) ^(T) =x _(i,1) a _(i,1) +x _(i,2) a _(i,2) + . . . +x _(i,n) a _(i,n)  (4)

t _(j) =X _(i) ×A _(j) ^(T) =x _(j,1) a _(i,1) +x _(j,2) a _(i,2) + . . . +x _(j,n) a _(i,n)(j≠i)  (5)

the equation (4) has the following meaning: for any subgroup V_(i), suppose the confidential vector calculated by its subgroup controller SC_(i) is X_(i) and the public vector received is A_(i), then SC_(i) calculates the group key k_(i)=X_(i)×A_(i) ^(T);

the equation (5) has the following meaning: for any subgroup V_(i), suppose the confidential vector calculated by its subgroup controller SC_(i) is X_(i), the public vector of other subgroups V_(j) (j=1, . . . , n and j≠i) in the group is represented as A_(j), then SC_(i) calculates the group key t_(j)=X_(i)×A_(j) ^(T) of V_(j), and if V_(j) is the direct or indirect descendant subgroup of V_(i), then t_(j)≠0 and t_(j) is the group key of the subgroup V_(j), while if V_(j) is not the direct nor indirect descendant subgroup of V_(i), then t_(j)=0, and V_(i) can not calculate the group key of V_(j).

wherein P(j) represents the set of all ancestor nodes of the subgroup V_(i); if V_(i)εP(j), then t_(j)=k_(j), i.e. t_(j) is equal to the group key of V_(j); or else, t_(j)=0; each subgroup V_(i) can easily calculate its group key or the group keys of its descendant nodes via the equations (4) and (5);

the subgroup controller SC_(i) distributes the calculated k_(i) and t_(j) (j≠i) to each group member (the specific delivering process is determined by the key management scheme in the group).

When ordinary members (not subgroup controllers) apply to join in the subgroup, the hierarchical group key management approach based on linear geometry further comprises:

step 5, when ordinary members (not subgroup controllers) request to join in, suppose the current group has n subgroups, wherein g subgroups have new members requesting to join in, then the controllers of the subgroups, where the new users join, send the joining request to the central controller (the new members can be allowed simultaneously to join in the group by bulk processing), wherein g≦n; repeat the steps 2 to 4.

When ordinary members (not subgroup controllers) apply to leave the subgroup, the hierarchical group key management approach based on linear geometry further comprises:

step 5, when ordinary members (not subgroup controllers) request to leave the group: suppose the current group has n subgroups, wherein g subgroups have members requesting to leave, then the controllers of the subgroups, where users request to leave, send the leaving request to the central controller (the update of key can be done by bulk processing), wherein g≦n;

repeat the steps 2 to 4.

When ordinary members (not subgroup controllers) request to join in and ordinary members request to leave, the hierarchical group key management approach based on linear geometry further comprises:

step 5, when a large number of ordinary members join in and leave, that is, a large number of new users request to join in some subgroups while some members in some subgroups apply to leave, then the controllers of the subgroups, where the new users join, send the joining request to the central controller, and subgroup controllers which users request to leave send the leaving request to the central controller;

repeat the steps 2 to 4.

A subgroup may be split into new subgroups, and the new subgroups will join in the system after the new subgroups select new subgroup controllers; the hierarchical group key management approach based on linear geometry further comprises:

step 5, when new subgroups join in, the central controller assigns a serial number to each subgroup controller and sends the serial number to all the subgroup controllers; meanwhile, the central controller selects a N-dimensional private vector over the finite field F for each new subgroup and sends the N-dimensional private vector to the corresponding subgroup controller via secure channel; the new subgroup controllers receive the private vectors sent by the central controller and keep secret; the central controller sends the finite field F, the constant N and the mapping f to the new subgroup controllers;

repeat the steps 2 to 4.

The deletion or combination of subgroups will cause the leaving of subgroup controller members; and the hierarchical group key management approach based on linear geometry further comprises:

step 5, when subgroups need to leave, each subgroup member that needs to leave applies to the central group controller for leaving the group; the central group controller deletes the private vectors of the leaving subgroups, and reassigns serial numbers according to the size order of the subscripts of the current subgroup members, and sends the serial numbers to all subgroup controllers by broadcasting or multicasting;

repeat the steps 2 to 4.

When a large number of subgroup controller members join in and a large number of subgroup controller members leave simultaneously, the hierarchical group key management approach based on linear geometry further comprises:

step 5: when a large number of new subgroup controllers join in and a large number of subgroup controllers leave simultaneously, each leaving subgroup controller applies to the central controller for leaving; the central controller deletes the private vector of the leaving subgroup controller, and reassigns serial numbers for the remaining subgroup controllers according to the size order of the subscripts of the current subgroup controllers while assigns a serial number for each new subgroup controller, then sends the serial numbers to all subgroup controllers; the central controller selects a N-dimensional private vector randomly over the finite field F for each new joining subgroup, and sends the N-dimensional private vector to the corresponding subgroup controller; the new joining subgroup controllers receive the private vector sent by the central controller and keep secret; the central controller sends the finite field F, the constant N and the mapping f to the new joining subgroup controllers;

repeat the steps 2 to 4.

When ordinary users and subgroup controller users join in together, and/or ordinary users and subgroup controller users leave simultaneously, the hierarchical group key management approach based on linear geometry further comprises:

step 5: when a large number of ordinary users and subgroup controllers join in, and/or ordinary users and subgroup controllers leave simultaneously, each leaving subgroup controller applies to the central controller for leaving; the subgroup controllers which the ordinary users join in or leave send a request for updating the key to the central controller; the central controller deletes the private vectors of the leaving controller, and reassigns serial numbers according to the size order of the subscripts of the current subgroup members while assigns a serial number to each new joining subgroup controller, and then sends the serial numbers to all subgroup controllers; the central controller selects a N-dimensional private vector over the finite field for each new joining subgroup, and sends the N-dimensional private vector to the corresponding subgroup controller via secure channel; the new joining subgroup controllers receive the private vectors sent by the central controller and keep secret; the central controller sends the finite field F, the constant N and the mapping f to the new joining subgroup controllers;

repeat the steps 2 to 4.

The second object of the present invention is achieved by the following technical solution:

A hierarchical group key management approach based on linear geometry, comprises the following steps:

step 1: a central controller CC selects a mapping f and a finite field F for use by a group, all computations in the group are performed over the finite field; a constant m is determined by the central controller; the central controller sends the finite field F, the constant m and the mapping f to all subgroup controllers; suppose the group has n subgroups, the central controller assigns a serial number for each subgroup and sends each serial numbers to each subgroup controller; the central controller selects a m-dimensional private vector and a two-dimensional private vector randomly for each subgroup, and sends them to the corresponding subgroup controller via secure channel; the subgroup controllers receive and store the m-dimensional private vectors and the two-dimensional private vectors and keep secret, wherein m and n are positive integers, and 2≦m≦n;

step 2: the central controller selects a mapping parameter r in the finite field F, and maps the two-dimensional private vectors of all the subgroup controllers into a new set of vectors by using the mapping f according to the mapping parameter r, and maps the m-dimensional private vectors of all the subgroup controllers into a new set of vectors in the vector space by using the mapping f if the new set of vectors is linearly dependent, then the mapping parameter is reselected to perform remapping, or return to the step 1 to allow each subgroup controller to reselect a private vector, until the new set of vectors is linearly independent; these two new sets of subgroups are called confidential vectors;

step 3: the central controller selects a subgroup key in the finite field F for each subgroup, the central controller constructs n linear systems of equations according to the hierarchy relationship of the subgroups by using the confidential vectors and the subgroup keys, and the central controller calculates the unique solutions of the linear systems of equations which are called public vectors; the confidential vectors and the public vectors are subject to the following regulations: (1) for all the nodes, the inner product of the m-dimensional confidential vector and the public vector of a current node itself is the group key of the current node; (2) the m-dimensional confidential vectors of lower level nodes are orthogonal to the public vectors of higher level nodes, and the inner product is zero; (3) when the higher level node is a parent node or ancestor node of the current node, the inner product of the m-dimensional confidential vector of the higher level node and the public vector of all the descendant nodes is the indirect key; the higher level node further calculates the key of the descendant node via the key and the two-dimensional confidential vector of the higher level node itself; (4) for nodes without direct nor indirect ancestor-descendant relationship with respect to each other, the inner product of the m-dimensional confidential vector of one node and the public vector of the other node is zero; (5) the key of one node can not be derived by the other node between brother nodes, and the inner product of the confidential vector of one node and the public vector of the other is zero; n sets of public vectors form a public matrix, and the public matrix and the mapping parameter r are broadcasted or multicasted by the central controller to all the subgroup controllers via open channel;

step 4: after receiving the public matrix and the mapping parameter, each subgroup controller maps the two private vectors of its own to two new vectors i.e. confidential vectors, in a vector space according to the mapping parameter, and a set of key vectors is derived from linear transformation of the m-dimensional confidential vector and the public matrix, the subgroup controller obtains its group key through the key vector calculated by itself, and calculates the group keys of descendant subgroups through the key vector calculated by itself and the two-dimensional confidential vector of its own, and the descendant subgroups can not calculate the group keys of their parent groups and ancestor groups; the subgroup controller distributes the group keys calculated to group members.

Preferably, the step 1 is implemented by the following:

the central controller determines a finite field F, a constant m and a mapping f, and sends the finite field F, the constant m and the mapping f to all the subgroup controllers SC_(i); the central controller selects a m-dimensional private vector Z_(i)=(z_(i,1), z_(i,2), . . . , z_(i,m)) and a two-dimensional private vector Y_(i)=(y_(i,1),y_(i,2)) over the finite filed F for each subgroup, and sends Z_(i) and Y_(i) to the corresponding subgroup controller SC_(i) via secure channel;

the subgroup controller SC_(i) receives and stores the private vectors Z_(i) and Y_(i) and keeps secret, the central controller assigns a serial number SC_(i) for each subgroup controller, and sends the serial number SC_(i) to all the subgroup controllers by broadcasting or multicasting, wherein i=1, . . . , n;

the step 2 is implemented by the following:

the central controller selects a mapping parameter r in the finite field F randomly, and maps the private vectors Z_(i) of all the subgroups into a new set of vectors X_(i) by using the mapping f, and maps the private vectors Y_(i) of all the subgroups into a new set of vectors W_(i), wherein X_(i) and W_(i) are called confidential vectors;

$\begin{matrix} {{{{for}\mspace{14mu} {all}\mspace{14mu} {subgroups}\mspace{14mu} {SC}_{i}},{i = 1},\ldots \;,n,{{{the}\mspace{14mu} {vector}\mspace{14mu} W_{i}} = {{\left( {w_{i,1},w_{i,2}} \right):w_{i,1}} = {f\left( {y_{i,1},r} \right)}}}}{w_{i,2} = {f\left( {y_{i,2},r} \right)}}} & (1) \\ {{{{{for}\mspace{14mu} i} = 1},\ldots \;,m,{X_{i} = {{\left( {x_{i,1},\ldots \;,x_{i,m},0,\ldots \;,0} \right):x_{i,1}} = {f\left( {z_{i,1},r} \right)}}}}\ldots {x_{i,m} = {f\left( {z_{i,m},r} \right)}}{{{{Let}\mspace{14mu} x_{i,{m + 1}}} = {\ldots = {x_{i,n} = 0}}};}} & (2) \\ {{{{{for}\mspace{14mu} i} = {m + 1}},\ldots \;,n,{X_{i} = \left( {x_{i,1},x_{i,2},\ldots \;,x_{i,{m - 1}},{0\ldots}\;,0_{x_{i,i}},0,\ldots \;,0} \right)}}{x_{i,1} = {f\left( {z_{i,1},r} \right)}}\ldots {x_{i,{m - 1}} = {f\left( {z_{i,{m - 1}},r} \right)}}{x_{i,i} = {f\left( {z_{i,m},r} \right)}}{{{{Let}\mspace{14mu} x_{i,m}} = {\ldots = {x_{i,{i - 1}} = 0}}},{{x_{i,{i + 1}} = {\ldots = {x_{i,n} = 0}}};}}} & (3) \end{matrix}$

then the central controller obtains a set of n-dimensional vectors consisting of X_(i) over the finite field F:

X₁ = (x_(1, 1), x_(1, 2), … , x_(1, n)) X₂ = (x_(2, 1), x_(2, 2), … , x_(2, n)) … X_(n) = (x_(n, 1), x_(n, 2), … , x_(n, n))

the central controller judges whether X_(i), X₂, . . . , X_(n) are linearly dependent, and if they are linearly dependent, then proceed to the step 2 to reselect the mapping parameter and to perform remapping, or return to the step 1 to allow the subgroup controller to reselect a private vector until the new set of vectors are linearly independent; or else proceed to step 3, and it is very easy to obtain a set of vector X₁, X₂, . . . , X_(n) that are linearly independent, because r is a random number;

the step 3 is implemented by the following:

the central controller selects a group key k_(i,i), i=1, . . . , n, for each subgroup; for any subgroup controller SC_(i), i=1, . . . , n, suppose its public vector A_(i)=(a_(i,1), a_(i,2), . . . , a_(i,n)) is an unknown parameter, and C(V_(i)) is used to represent a set of all descendant groups of the subgroup controller SC_(i), then the public vector A_(i) and the confidential vector X_(j) of each subgroup have the following relationship:

X _(i) ×A _(i) ^(T) =k _(i,i)

suppose V_(j)εC(V_(i)), i.e. V_(j)(j=1, . . . , n) is the direct or indirect descendant subgroup of V and j i, then A_(j), X_(i), W_(i) and X_(j) have the following relationship:

$\begin{matrix} \left\{ \begin{matrix} {{X_{j} \times A_{j}^{T}} = k_{j,j}} \\ {{X_{i} \times A_{j}^{T}} = k_{i,j}} \\ {{W_{i} \times \left( {k_{i,i},k_{i,j}} \right)^{T}} = k_{j,j}} \end{matrix} \right. & (6) \end{matrix}$

it is derived from the equation (6) that:

$\begin{matrix} {{X_{i} \times A_{j}^{T}} = {k_{i,j} = \left\{ \begin{matrix} {k_{i,i},{j = i}} \\ {{\left( {k_{j,j} - {w_{i,1}k_{i,i}}} \right)w_{i,2}^{- 1}},{{j \neq {i\bigcap V_{j}}} \in {C\left( V_{i} \right)}}} \\ {0,{{j \neq {i\bigcap V_{j}}} \notin {C\left( V_{i} \right)}}} \end{matrix} \right.}} & (7) \end{matrix}$

the equation (7) has the following meaning: for any subgroup V_(i), its n-dimensional confidential vector is X_(i), two-dimensional confidential vector is W_(i)=(w_(i,1),w_(i,2)), the public vector is A_(i), and the key is k_(i,i); the public vectors of all subgroups V_(j)(j=1, . . . , n) is represented by A_(j)=(a_(j,1), a_(j,2), . . . , a_(j,n)); (1) if j=i, A_(j)=A_(i) and k_(i,j)=k_(i,i), and at this time, k_(i,j)=X×A_(j) ^(T)=X_(i)×A_(i) ^(T)=k_(i,i) is the group key of the subgroup V_(i); (2) if j≠i and V_(j) is the direct or indirect descendant subgroup of V_(i), the subgroup V_(i) can calculate the group key k_(j,j) of V_(j) through the indirect key k_(i,j), and it can be derived from the equation (6) that X_(i)×A_(j) ^(T)=k_(i,j)=(k_(j,j)−w_(i,1)k_(i,i))w_(i,2) ⁻¹; (3) if j≠i and V_(j) is the direct or indirect descendant subgroup of V_(i), then k_(i,j)=X_(i)×A_(j) ^(T)=0, and at this time, V_(i) can not calculate the key k_(j,j) of V_(j) through k_(i,j);

suppose X=(X₁, X₂, . . . , X_(n)), K_(i)=(k_(i,1), k_(i,2), . . . , k_(i,n))^(T), then the equation (7) is transformed into:

X×A ^(T) =K _(i)

let A=(A₁ ^(T), A₂ ^(T), . . . , A_(n) ^(T)), K=(K₁, K₂, . . . , K_(n)), and for all the V_(i), then:

X×A=K  (8)

the equation (8) is written in the form of a system of equations:

${\begin{bmatrix} x_{1,1} & x_{1,2} & \ldots & x_{1,n} \\ x_{2,1} & x_{2,2} & \ldots & x_{2,n} \\ \ldots & \ldots & \ldots & \ldots \\ x_{n,1} & x_{n,2} & \ldots & x_{n,n} \end{bmatrix} \times \begin{bmatrix} a_{1,1} & a_{2,1} & \ldots & a_{n,1} \\ a_{1,2} & a_{2,2} & \ldots & a_{n,2} \\ \ldots & \ldots & \ldots & \ldots \\ a_{1,n} & a_{2,n} & \ldots & a_{n,n} \end{bmatrix}} = \begin{bmatrix} k_{1,1} & k_{1,2} & \ldots & k_{1,n} \\ k_{2,1} & k_{2,2} & \ldots & k_{2,n} \\ \ldots & \ldots & \ldots & \ldots \\ k_{n,1} & k_{n,2} & \ldots & k_{n,n} \end{bmatrix}$

the central controller solves the system of equations (8), and the system of equations (8) has a unique solution: A=X⁻¹K, since the step 3 guarantees the coefficient matrix determinant |X|≠0, and A is the public matrix solved; the mapping parameter r and the matrix A=(A₁ ^(T), A₂ ^(T), . . . , A_(n) ^(T)) are broadcasted or multicasted by the central controller to all the subgroup controllers via open channel;

the step 4 is implemented by the following:

when each subgroup controller receives the public matrix A=(A₁ ^(T), A₂ ^(T), . . . , A_(n) ^(T)) and the mapping parameter r, each subgroup controller SC_(i) calculates W_(i) and X_(i) according to the serial number i of its own and the mapping f:

$\begin{matrix} {{{{{for}\mspace{14mu} {all}\mspace{14mu} {the}\mspace{14mu} i} = 1},\ldots \;,n,{W_{i} = \left( {w_{i,1},w_{i,2}} \right)}}{w_{i,1} = {f\left( {y_{i,1},r} \right)}}{w_{i,2} = {f\left( {y_{i,2},r} \right)}}} & (1) \\ {{{{{{for}\mspace{14mu} i} = 1},\ldots \;,m,{X_{i} = {{\left( {x_{i,1},\ldots \;,x_{i,m},0,\ldots \;,0} \right):x_{i,1}} = {f\left( {z_{i,1},r} \right)}}}}\ldots x_{i,m} = {f\left( {z_{i,m},r} \right)}}{{{{let}\mspace{14mu} x_{i,{m + 1}}} = {\ldots = {x_{i,n} = 0}}};}} & (2) \\ {{{{{{for}\mspace{14mu} i} = {m + 1}},\ldots \;,n,{X_{i} = \left( {x_{i,1},x_{i,2},\ldots \;,x_{i,{m - 1}},{0\ldots}\;,0_{x_{i,i}},0,\ldots \;,0} \right)}}{x_{i,1} = {f\left( {z_{i,1},r} \right)}}\ldots {x_{i,{m - 1}} = {f\left( {z_{i,{m - 1}},r} \right)}}x_{i,i} = {f\left( {z_{i,m},r} \right)}}{{{{let}\mspace{14mu} x_{i,m}} = {\ldots = {x_{i,{i - 1}} = 0}}},{{x_{i,{i + 1}} = {\ldots = {x_{i,n} = 0}}};}}{{{{then}\mspace{14mu} {for}\mspace{14mu} {all}\mspace{14mu} {the}\mspace{14mu} j} = 1},\ldots \;,n,{calculate},}} & (3) \\ {k_{i,j} = \left\{ \begin{matrix} {{{{X_{i} \times A_{j}^{T}} = {{x_{i,1}a_{j,1}} + \ldots + {x_{i,m}a_{j,m}}}},}} & {i \leq m} \\ {{{{X_{i} \times A_{j}^{T}} = {{x_{i,1}a_{j,1}} + \ldots + {x_{i,{m - 1}}a_{j,{m - 1}}} + x_{i,i}}},a_{j,i},}} & {i > m} \end{matrix} \right.} & (9) \end{matrix}$

the equation (9) has the following meaning: for the subgroup V_(i), the subgroup controller is SC_(i), the n-dimensional confidential vector is X_(i), and the two-dimensional confidential vector is W_(i)=(w_(i,1),w_(i,2)); the public vectors of all the subgroups in the group are represented by A_(j)=(a_(j,1), a_(j,2), . . . , a_(j,n)) (j=1, . . . , n); if j=i, then A_(j)=A_(i) and k_(i,j)=k_(i,i), and at this time, k_(i,j) is the group key of the subgroup V_(i); if j≠i and k_(i,j)≠0, V_(i) can calculate the group key k_(j,j) of V_(j) through k_(i,j), and V_(j) is the direct or indirect descendant subgroup of V_(i); if j≠i and k_(i,j)=0, it reveals that V_(i) can not calculate the key k_(j,j) of V_(j); the calculation of k_(i,j) has the following two situations: (1) if 1≦i≦m, X_(i)=(x_(i,1), . . . , x_(i,m), 0, . . . , 0), then k_(i,j)=X_(i)×A_(j) ^(T)=x_(i,1)a_(i,1)+ . . . +x_(i,m)a_(j,m); (2) if m+1≦i≦n, X_(i)=(x_(i,1), . . . , x_(i,m-1), 0, . . . , 0, x_(i,i), 0, . . . , 0), then k_(i,j)=X_(i)×A_(j) ^(T)=x_(i,1)a_(i,1)+ . . . +x_(i,m-1)a_(j,m-1)+x_(i,i)a_(j,i).

if j≠i, the subgroup controller SC_(i) continues to calculate the group key k_(j,j) of the subgroup V_(j) if k_(i,j)≠0:

k _(j,j) =w _(i,1) ×k _(i,i) +w _(i,2) ×k _(i,j)  (10)

each subgroup controller SC_(i) can easily calculate the key k_(i,i) and the key k_(j,j) of each descendant subgroup via the equations (9) and (10); the subgroup controller SC_(i) distributes the k_(i,i) and k_(j,j) (j=1, . . . , n and j≠i) calculated to each group member.

When ordinary members (not subgroup controllers) request to join the subgroup, the hierarchical group key management approach based on linear geometry further comprises:

step 5, when ordinary members (not subgroup controllers) join in: suppose the current group has n subgroups, wherein g subgroups have new members requesting to join in, then the controllers of the subgroups, where new users join, send the joining request to the central controller (the new members can be allowed simultaneously to join in the group by bulk processing), wherein g≦n;

repeat the steps 2 to 4.

When ordinary members (not subgroup controllers) request to leave the subgroup, the hierarchical group key management approach based on linear geometry further comprises:

step 5, when ordinary members (not subgroup controllers) request to leave the group: suppose the current group has n subgroups, wherein g subgroups have members requesting to leave, then the controllers of the subgroups, where users request to leave, send the leaving request to the central controller (the update of keys can be done by bulk processing), wherein g≦n;

repeat the steps 2 to 4.

When some ordinary members (not subgroup controllers) request to join in while some ordinary members would like to leave, the hierarchical group key management approach based on linear geometry further comprises:

step 5, when a large number of ordinary members join in and leave, that is, a large number of new users request to join in some subgroups while some members in some subgroups request to leave, then the controllers of the subgroups, where the new users join, send the joining request to the central controller, and subgroup controllers which users request to leave send the leaving request to the central controller;

repeat the steps 2 to 4.

When subgroup controller members (bulk) join in, the hierarchical group key management approach based on linear geometry further comprises:

step 5: when new subgroups join in, the central controller selects a m-dimensional private vector Z_(i)=(z_(i,1), z_(i,2), . . . z_(i,m)) and a two-dimensional private vector Y_(i)=(y_(i,1),y_(i,2)) for each new subgroup controller over the finite field F, and sends them to the corresponding subgroup controller; the central controller assigns a serial number to each new subgroup controller, and sends the serial number to all subgroup controllers; each new subgroup controller receives the m-dimensional private vector and the two-dimensional private vector sent by the central controller and keeps secret; the central controller sends the finite field F, the constant N, and the mapping f to the new subgroup controller;

repeat the steps 2 to 4.

When subgroup controller members (bulk) leave the group, the hierarchical group key management approach based on linear geometry further comprises:

step 5: when subgroups need to leave, each leaving subgroup member applies to the central group controller for leaving the group; the central group controller deletes the private vectors of the leaving subgroups, and reassigns serial numbers according to the size order of the subscripts of the current subgroup members, and sends the serial numbers to all subgroup controllers by broadcasting or multicasting;

repeat the steps 2 to 4.

When a large number of subgroup controller members join in and a large number of subgroup controller members leave simultaneously, the hierarchical group key management approach based on linear geometry further comprises:

step 5: each leaving subgroup controller applies to the central controller for leaving; the central controller deletes the private vector of the leaving subgroup controller, reassigns serial numbers for the subgroup controllers according to the size order of the subscripts of the current subgroup controllers, assigns a serial number to each new subgroup controller, and sends the subscript serial numbers of all members to all subgroup controllers via broadcasting or multicasting; the central controller selects a m-dimensional private vector Z_(i)=(z_(i,1), z_(i,2), . . . , z_(i,m)) and a two-dimensional vector Y_(i)=(y_(i,1),y_(i,2)) randomly over the finite field F for each new joining subgroup, and sends them to the corresponding subgroup controller via secure channel; the central controller assigns a serial number to each new subgroup and sends the serial number to all the subgroup controllers; each new subgroup controller receives the m-dimensional private vector and the two-dimensional private vector sent by the central controller and keeps secret; the central controller sends the finite field F, the constant N and the mapping f to the new joining subgroup controllers;

repeat the steps 2 to 4.

When a large number of ordinary users and subgroup controllers join in, and/or ordinary users and subgroup controllers leave, the hierarchical group key management approach based on linear geometry further comprises:

step 5: when a large number of ordinary users and subgroup controllers join in, and/or ordinary users and subgroup controllers leave, each leaving subgroup controller applies to the central controller for leaving; the controllers of the subgroups, where the ordinary users join or leave, send a request for updating the key to the central controller; the central controller deletes the private vectors of the leaving subgroup controllers, and reassigns serial numbers according to the size order of the subscripts of the current subgroup members while assigns a serial number to each new joining subgroup controller, and then sends the serial numbers to all subgroup controllers via broadcasting or multicasting; the central controller selects a m-dimensional private vector Z_(i)=(z_(i,1), z_(i,2), . . . , z_(i,m)) and a two-dimensional vector Y_(i)=(y_(i,1),y_(i,2)) randomly over the finite field F for each new joining subgroup, and sends them to the corresponding subgroup controller via secure channel; the central controller assigns a serial number to each new subgroup controller and sends the serial number to all the subgroup controllers; each new subgroup controller receives the m-dimensional private vector and the two-dimensional private vector sent by the central controller and keeps secret; the central controller sends the finite field F, the constant N and the mapping f to the new subgroup controllers;

repeat the steps 2 to 4.

Preferably, said m is 2.

Preferably, suppose that the mapping f is represented by z=f(w,b), wherein w, b, zεF, the main function of the mapping f is randomization, and the mapping f conforms to the following characteristics:

1) it is easy to calculate z=f(w,b) if w and b are known;

2) it is difficult to calculate w if only z and b are known; if only z and w are known, it is also difficult to calculate b from z=f(w,b); it is difficult to calculate w from z_(i)=f(w,b_(i)), though a series of z_(i) and b_(i) is obtained; and it is also difficult to calculate b from z_(i)=f(w_(i),b) though a series of z_(i) and w_(i) are obtained.

Preferably, the hierarchical group key management approach based on linear geometry further comprises auto update: if no group member joins in or leaves the group for a preset period of time, then the group controller will update the group key of each subgroup periodically; the group controller reselects a new private vector for each subgroup and sends the new private vector to the corresponding subgroup controller, the subgroup controller receives the new private vector and keeps secret; the central controller reselects the mapping parameter and the group key of each subgroup, calculates the public matrix, broadcasts or multicasts the public matrix and the mapping parameter to all subgroup controllers by the central controller via open channel.

Compared with the prior art, the present invention has the following advantages:

Firstly, the secure channel is required only when the initialization and auto update of the group. During the initialization of the group, the group has not yet been established, so the secure channel is needed in order to ensure the security of the private vector; the auto update should update the private vectors of the subgroups, thus this can prevent the system security from being affected by the leakage of private vectors; and during the communication after then, the central controller only needs to send the central vector A and the mapping parameter r to all the group members, and because the vector A and r are both public, it is not necessary to keep secret, the secure channel is not required, and hence the open channel can be used for broadcasting and multicasting.

Secondly, the method of the present invention is independent of other cryptography methods. The security of the present invention is based on the linear geometry theory over the finite field, only simple mapping function and basic operation over the finite field is used during the process of calculating the group key, and it does not rely on other traditional cryptography methods including asymmetric cryptography, symmetric cryptography, and hash function. In this way, the possibility that the present invention is attacked by other aspects is reduced. Even if the traditional cryptography methods are broken, the security provided by the present invention will not be affected.

Thirdly, the storage and the computation cost of each member and the group controller are reduced. The subgroup controller SC_(i) only has to store the private vector Z_(i) of this subgroup, while the computation amount of each subgroup controller SC_(i) is the amount of calculating the group key and the confidential vector X_(i) in step 7.

Fourthly, the computation of the group controller can be easily parallelized. For the central controller or subgroup controller, if the group controller operates on a multi-core processor platform, then it is very easy to enable the computation of the group controller to be parallel by using the current popular parallel computing library, which takes the advantage of the multi-core processor.

Fifthly, the subgroup does not have to know and store the hierarchical structure of the group, the computation result will reveal whether a subgroup is a descendant subgroup. Meanwhile, the hierachical structure of the entire group is hidden. Though the ancestor subgroup knows whether a subgroup is its descendant subgroup, it can not know its path to the descendant subgroup. This will be useful to improve the security of the system.

The present invention can provide sufficient security, and the specific security is analysized as follows:

Firstly, forward and backward secrecy is provided. The group key k_(i) is randomly selected, and k_(i) will be changed each time the group members join or leave. The group key k_(i) will be updated periodly, and the key will be different at different period of time. Therefore, the security is improved, and the forward and backward secrecy can be guaranteed.

Secondly, the approach provides the security guaranty among different levels: a higher level node can derive the keys of its direct or indirect descendant nodes (at lower level), but not vice versa. The mapping parameter and the public matrix A are public, and the higher level node can calculate the keys of its descendant nodes, but the descendant node can not know the private vector Z_(i) of its parent node, and therefore X_(i) can not be calculated, and the key k_(i) of its parent node can not be calculated either. Thus, this approach can guarantee the security among different levels.

Thirdly, the subgroups without direct nor indirect ancestor-descendant relationship can not know the subgroup key of each other. The subgroups without direct nor indirect ancestor-descendant relationship can not calculate the confidential vector X_(i) of one another. Establish equations about X_(i), but since there are at most n number of equations and at least n+1 number of unknown quantity (the key k_(i) of the subgroup V_(i) is only known by V_(i) and its parent group nodes), the subgroups without direct nor indirect ancestor-descendant relationship can not calculate the key of one another.

Fourthly, members outside the group can not calculate k_(i). In this approach, A and r are sent via a public channel, and members outside the group can not calculate any k_(i) based on A and r.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic diagram of an architecture of group communication system with hierarchical access control according to a first embodiment of the invention;

FIG. 2 is a schematic diagram of a hierarchical access structure of a group according to the first embodiment of the invention;

FIG. 3 is a schematic diagram of the communication process during the initialization of the group according to the first embodiment of the invention;

FIG. 4 is a schematic diagram showing the variables and the relationship of CC and SC_(i) after the group is established according to the first embodiment of the invention;

FIG. 5 is a schematic diagram showing that subgroups join in and leave the group simultaneously according to a second embodiment of the invention;

FIG. 6 is a schematic diagram showing the communication between CC and a new joining subgroup SC_(i) according to the second embodiment of the invention;

FIG. 7 is a schematic diagram showing that a new group is established after the group has finished all the operations regarding the joining and leaving of subgroups according to the second embodiment of the invention;

FIG. 8 is a schematic diagram showing an architecture of group communication system with hierarchical access control according to a third embodiment of the invention;

FIG. 9 is a schematic diagram showing a hierachical access structure of the group according to the third embodiment of the invention;

FIG. 10 is a schematic diagram of the communication process during the initialization of the group according to the third embodiment of the invention;

FIG. 11 is a schematic diagram showing the variables and the relationship of CC and SC_(i) after the group is established according to the third embodiment of the invention;

FIG. 12 is a schematic diagram that subgroups join in and leave the group simultaneously according to a fourth embodiment of the invention;

FIG. 13 is a schematic diagram showing the communication of CC and a new joining subgroup SC_(i) according to the fourth embodiment of the invention;

FIG. 14 is a schematic diagram showing that a new group is established after the group has finished all the operations regarding the joining and leaving of subgroups according to the fourth embodiment of the invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

The invention will be further described in detail in the following embodiments accompanying the drawings. It will nevertheless be understood that no limitation of the scope of the invention is thereby intended.

Embodiment 1

Referring to FIG. 1, a group communication system with hierarchical access control includes a central controller CC, subgroups V_(i), subgroup controllers SC_(i), and the central controller CC and the subgroups V_(i) are connected via internet, wherein i=1, 2, . . . , 7.

The group hierarchical access structure is shown in FIG. 2. All the higher level nodes can derive the keys of its direct or indirect descendant nodes, while the lower level nodes can not derive the keys of its ancestor nodes. The nodes without direct nor indirect ancestor-descendant relationship can not know the subgroup key of each other. The key of one node can not be derived by the other node if they are brother nodes.

As shown in FIG. 3, the system selects the finite field F, and all computations in the group are performed over the finite field F; meanwhile, a pseudo-random number generator is selected to be used as f(.,.); for the same initialization input (seed), the pseudo-random number generator should have the same output sequence; at initialization, let N=10.

Step 1: when the subgroup V_(i) would like to join in the group, the central controller CC selects a private vector Z_(i)=(z_(i,1), z_(i,2), . . . , z_(i,10)) (z_(i,j)εF, j=1, . . . , 10) randomly for each subgroup V; sends the private vector to the corresponding subgroup controller via secure channel, and the subgroup controller stores the private vector and keeps secret; CC assigns a serial number SC_(i) for the subgroup controller of the subgroup V_(i), and the serial number is broadcasted or multicasted to all the subgroup controllers via public channel, wherein i=1, 2, . . . , 7;

Step 2: the central controller CC selects a random number r in the finite field F to be used as the mapping parameter, and maps all the private vectors Z_(i) into a new set of vectors X_(i)=(x_(i,1), x_(i,2), . . . , x_(i,7)) via the mapping f(•,•), wherein i=1, 2, . . . , 7:

x_(1, 1) = f(z_(1, 1), r) x_(1, 2) = f(z_(1, 2), r) … , x_(1, 7) = f(z_(1, 7), r) … , x_(7, 1) = f(z_(7, 1), r) x_(7, 2) = f(z_(7, 2), r) … , x_(7, 7) = f(z_(7, 7), r)

then CC obtains a new set of vectors over the finite field F, called confidential vectors:

X₁ = (x_(1, 1), x_(1, 2), … , x_(1, 7)) X₂ = (x_(2, 1), x_(2, 2), … , x_(2, 7)) … , X₇ = (x_(7, 1), x_(7, 2), … , x_(7, 7))

The central controller CC judges whether X₁, X₂, . . . , X₇ are linearly dependent, and if they are linearly independent, then proceed to the step 3; otherwise, return to the step 2. (Since r is a random number, it is easy to obtain a set of vectors X₁, X₂, . . . , X₇ that are linearly independent).

Step 3: suppose the public vector is A_(i)=(a_(i,1), a_(i,2), . . . , a_(i,7)); CC selects a key randomly in the finite field F for each subgroup controller SC_(i), respectively, k₁, k₂, . . . , k₇, and k_(i)≠0 (i=1, 2, . . . , 7); CC calculates the public matrix A from the following systems of equations, wherein i=1, 2, . . . , 7:

(1) for V₁, only V₁ can derive k₁, and the other V_(i)(i=2, 3, . . . , 7) can not derive k₁. The relationship of each X_(i)(i=1, 2, . . . , 7), the public vector A₁ and the key k₁ is as follows:

X ₁ ×A ₁ ^(T) =k ₁

X ₂ ×A ₁ ^(T)=0

X ₃ ×A ₁ ^(T)=0

X ₄ ×A ₁ ^(T)=0

X ₅ ×A ₁ ^(T)=0

X ₆ ×A ₁ ^(T)=0

X ₇ ×A ₁ ^(T)=0

Suppose X=(X₁, X₂, . . . , X₇), K₁=(k₁, 0, 0, 0, 0, 0, 0)^(T), then it can be written in matrix form as: X×A₁ ^(T)=K₁, while it can also be represented by a system of equations as follows:

$\left\{ {\begin{matrix} {{{x_{1,1}a_{1,1}} + {x_{1,2}a_{1,2}} + \ldots + {x_{1,7}a_{1,7}}} = k_{1}} \\ {{{x_{2,1}a_{1,1}} + {x_{2,2}a_{1,2}} + \ldots + {x_{2,7}a_{1,7}}} = 0} \\ {{{x_{3,1}a_{1,1}} + {x_{3,2}a_{1,2}} + \ldots + {x_{3,7}a_{1,7}}} = 0} \\ {{{x_{4,1}a_{1,1}} + {x_{4,2}a_{1,2}} + \ldots + {x_{4,7}a_{1,7}}} = 0} \\ {{{x_{5,1}a_{1,1}} + {x_{5,2}a_{1,2}} + \ldots + {x_{5,7}a_{1,7}}} = 0} \\ {{{x_{6,1}a_{1,1}} + {x_{6,2}a_{1,2}} + \ldots + {x_{6,7}a_{1,7}}} = 0} \\ {{{x_{7,1}a_{1,1}} + {x_{7,2}a_{1,2}} + \ldots + {x_{7,7}a_{1,7}}} = 0} \end{matrix}\quad} \right.$

(2) for V₂, both V₁ and V₂ can derive k₂, the other V_(i)(i=3, 4, . . . , 7) can not derive k₂. The relationship of each X_(i) (i=1, 2, . . . , 7), the public vector A₂ and key k₂ is as follows:

X ₁ ×A ₂ ^(T) =k ₂

X ₂ ×A ₂ ^(T) =k ₂

X ₃ ×A ₂ ^(T)=0

X ₄ ×A ₂ ^(T)=0

X ₅ ×A ₂ ^(T)=0

X ₆ ×A ₂ ^(T)=0

X ₇ ×A ₂ ^(T)=0

Suppose K₂=(k₂, k₂, 0, 0, 0, 0, 0)^(T), then it can be written in matrix form as: X×A₂ ^(T)=K₂; while it can also be represented by a system of equations as follows:

$\left\{ {\begin{matrix} {{{x_{1,1}a_{2,1}} + {x_{1,2}a_{2,2}} + \ldots + {x_{1,7}a_{2,7}}} = k_{2}} \\ {{{x_{2,1}a_{2,1}} + {x_{2,2}a_{2,2}} + \ldots + {x_{2,7}a_{2,7}}} = k_{2}} \\ {{{x_{3,1}a_{2,1}} + {x_{3,2}a_{2,2}} + \ldots + {x_{3,7}a_{2,7}}} = 0} \\ {{{x_{4,1}a_{2,1}} + {x_{4,2}a_{2,2}} + \ldots + {x_{4,7}a_{2,7}}} = 0} \\ {{{x_{5,1}a_{2,1}} + {x_{5,2}a_{2,2}} + \ldots + {x_{5,7}a_{2,7}}} = 0} \\ {{{x_{6,1}a_{2,1}} + {x_{6,2}a_{2,2}} + \ldots + {x_{6,7}a_{2,7}}} = 0} \\ {{{x_{7,1}a_{2,1}} + {x_{7,2}a_{2,2}} + \ldots + {x_{7,7}a_{2,7}}} = 0} \end{matrix}\quad} \right.$

(3) for V₃, only V₁ and V₃ can derive k₃, but other V_(i)(i=2, 4, 5, 6, 7) can not derive k₃. The relationship of each confidential vector X_(i) (i=1, 2, . . . , 7), the public vector A₃ and the key k₃ is as follows:

X ₁ ×A ₃ ^(T) =k ₃

X ₂ ×A ₃ ^(T)=0

X ₃ ×A ₃ ^(T) =k ₃

X ₄ ×A ₃ ^(T)=0

X ₅ ×A ₃ ^(T)=0

X ₆ ×A ₃ ^(T)=0

X ₇ ×A ₃ ^(T)=0

Suppose K₃=(k₃, 0, k₃, 0, 0, 0, 0)^(T), then it can be written in matrix form as: X×A₃ ^(T)=K₃; while it can also be represented by a system of equations as follows:

$\left\{ {\begin{matrix} {{{x_{1,1}a_{3,1}} + {x_{1,2}a_{3,2}} + \ldots + {x_{1,7}a_{3,7}}} = k_{3}} \\ {{{x_{2,1}a_{3,1}} + {x_{2,2}a_{3,2}} + \ldots + {x_{2,7}a_{3,7}}} = 0} \\ {{{x_{3,1}a_{3,1}} + {x_{3,2}a_{3,2}} + \ldots + {x_{3,7}a_{3,7}}} = k_{3}} \\ {{{x_{4,1}a_{3,1}} + {x_{4,2}a_{3,2}} + \ldots + {x_{4,7}a_{3,7}}} = 0} \\ {{{x_{5,1}a_{3,1}} + {x_{5,2}a_{3,2}} + \ldots + {x_{5,7}a_{3,7}}} = 0} \\ {{{x_{6,1}a_{3,1}} + {x_{6,2}a_{3,2}} + \ldots + {x_{6,7}a_{3,7}}} = 0} \\ {{{x_{7,1}a_{3,1}} + {x_{7,2}a_{3,2}} + \ldots + {x_{7,7}a_{3,7}}} = 0} \end{matrix}\quad} \right.$

(4) for V₄, the key k₄ can be derived by V₁, V₂ and V₄, but can not be derived by the other V_(i)(i=3, 5, 6, 7). The confidential vector X_(i)(i=1, 2, . . . , 7), the public vector A₄ and the key k₄ have the following relationship:

X ₁ ×A ₄ ^(T) =k ₄

X ₂ ×A ₄ ^(T) =k ₄

X ₃ ×A ₄ ^(T)=0

X ₄ ×A ₄ ^(T) =k ₄

X ₅ ×A ₄ ^(T)=0

X ₆ ×A ₄ ^(T)=0

X ₇ ×A ₄ ^(T)=0

Suppose K₄=(k₄, k₄, 0, k₄, 0, 0, 0)^(T), then it can be written in matrix form as: X×A₄ ^(T)=K₄; while it can also be represented by a system of equations as follows:

$\left\{ {\begin{matrix} {{{x_{1,1}a_{4,1}} + {x_{1,2}a_{4,2}} + \ldots + {x_{1,7}a_{4,7}}} = k_{4}} \\ {{{x_{2,1}a_{4,1}} + {x_{2,2}a_{4,2}} + \ldots + {x_{2,7}a_{4,7}}} = k_{4}} \\ {{{x_{3,1}a_{4,1}} + {x_{3,2}a_{4,2}} + \ldots + {x_{3,7}a_{4,7}}} = 0} \\ {{{x_{4,1}a_{4,1}} + {x_{4,2}a_{4,2}} + \ldots + {x_{4,7}a_{4,7}}} = k_{4}} \\ {{{x_{5,1}a_{4,1}} + {x_{5,2}a_{4,2}} + \ldots + {x_{5,7}a_{4,7}}} = 0} \\ {{{x_{6,1}a_{4,1}} + {x_{6,2}a_{4,2}} + \ldots + {x_{6,7}a_{4,7}}} = 0} \\ {{{x_{7,1}a_{4,1}} + {x_{7,2}a_{4,2}} + \ldots + {x_{7,7}a_{4,7}}} = 0} \end{matrix}\quad} \right.$

(5) for V₅, the key k₅ can be derived by V₁, V₂ and V₅, but can not be derived by other V_(i)(i=3, 4, 6, 7). The confidential vector X_(i) (i=1, 2, . . . , 7), the public vector A₅ and the key k₅ have the following relationship:

X ₁ ×A ₅ ^(T) =k ₅

X ₂ ×A ₅ ^(T) =k ₅

X ₃ ×A ₅ ^(T)=0

X ₄ ×A ₅ ^(T)=0

X ₅ ×A ₅ ^(T) =k ₅

X ₆ ×A ₅ ^(T)=0

X ₇ ×A ₅ ^(T)=0

Suppose K₅=(k₅, k₅, 0, k₅, 0, 0)^(T), then it can be written in matrix form as: X×A₅ ^(T)=K₅; while it can also be represented by a system of equations as follows:

$\left\{ {\begin{matrix} {{{x_{1,1}a_{5,1}} + {x_{1,2}a_{5,2}} + \ldots + {x_{1,7}a_{5,7}}} = k_{5}} \\ {{{x_{2,1}a_{5,1}} + {x_{2,2}a_{5,2}} + \ldots + {x_{2,7}a_{5,7}}} = k_{5}} \\ {{{x_{3,1}a_{5,1}} + {x_{3,2}a_{5,2}} + \ldots + {x_{3,7}a_{5,7}}} = 0} \\ {{{x_{4,1}a_{5,1}} + {x_{4,2}a_{5,2}} + \ldots + {x_{4,7}a_{5,7}}} = 0} \\ {{{x_{5,1}a_{5,1}} + {x_{5,2}a_{5,2}} + \ldots + {x_{5,7}a_{5,7}}} = k_{5}} \\ {{{x_{6,1}a_{5,1}} + {x_{6,2}a_{5,2}} + \ldots + {x_{6,7}a_{5,7}}} = 0} \\ {{{x_{7,1}a_{5,1}} + {x_{7,2}a_{5,2}} + \ldots + {x_{7,7}a_{5,7}}} = 0} \end{matrix}\quad} \right.$

(6) for V₆, the key k₆ can be derived by V₁, V₃ and V₆, but can not be derived by other V_(i)(i=2, 4, 5, 7). The confidential vector X_(i) (i=1, 2, . . . , 7), the public vector A₆ and the key k₆ have the following relationship:

X ₁ ×A ₆ ^(T) =k ₆

X ₂ ×A ₆ ^(T)=0

X ₃ ×A ₆ ^(T) =k ₆

X ₄ ×A ₆ ^(T)=0

X ₅ ×A ₆ ^(T)=0

X ₆ ×A ₆ ^(T) =k ₆

X ₇ ×A ₆ ^(T)=0

Suppose K₆=(k₆, 0, k₆, 0, 0, k₆, 0), then it can be written in matrix form as: X×A₆ ^(T)=K₆; while it can also be represented by a system of equations as follows:

$\left\{ {\begin{matrix} {{{x_{1,1}a_{6,1}} + {x_{1,2}a_{6,2}} + \ldots + {x_{1,7}a_{6,7}}} = k_{6}} \\ {{{x_{2,1}a_{6,1}} + {x_{2,2}a_{6,2}} + \ldots + {x_{2,7}a_{6,7}}} = 0} \\ {{{x_{3,1}a_{6,1}} + {x_{3,2}a_{6,2}} + \ldots + {x_{3,7}a_{6,7}}} = k_{6}} \\ {{{x_{4,1}a_{6,1}} + {x_{4,2}a_{6,2}} + \ldots + {x_{4,7}a_{6,7}}} = 0} \\ {{{x_{5,1}a_{6,1}} + {x_{5,2}a_{6,2}} + \ldots + {x_{5,7}a_{6,7}}} = 0} \\ {{{x_{6,1}a_{6,1}} + {x_{6,2}a_{6,2}} + \ldots + {x_{6,7}a_{6,7}}} = k_{6}} \\ {{{x_{7,1}a_{6,1}} + {x_{7,2}a_{6,2}} + \ldots + {x_{7,7}a_{6,7}}} = 0} \end{matrix}\quad} \right.$

(7) for V₇, the key k₇ can be derived by V₁, V₃ and V₇, but can not be derived by other V_(i)(i=2, 4, 5, 6). The confidential vector X_(i) (i=1, 2, . . . , 7), the public vector A₇ and the key k₇ have the following relationship:

X ₁ ×A ₇ ^(T) =k ₇

X ₂ ×A ₇ ^(T)=0

X ₃ ×A ₇ ^(T)=0

X ₄ ×A ₇ ^(T)=0

X ₅ ×A ₇ ^(T)=0

X ₆ ×A ₇ ^(T)=0

X ₇ ×A ₇ ^(T) =k ₇

Suppose K₇=(k₇, 0, k₇, 0, 0, k₇)^(T), then it can be written in matrix form as: X×A₇ ^(T)=K₇; while it can also be represented by a system of equations as follows:

$\left\{ {\begin{matrix} {{{x_{1,1}a_{7,1}} + {x_{1,2}a_{7,2}} + \ldots + {x_{1,7}a_{7,7}}} = k_{7}} \\ {{{x_{2,1}a_{7,1}} + {x_{2,2}a_{7,2}} + \ldots + {x_{2,7}a_{7,7}}} = 0} \\ {{{x_{3,1}a_{7,1}} + {x_{3,2}a_{7,2}} + \ldots + {x_{3,7}a_{7,7}}} = k_{7}} \\ {{{x_{4,1}a_{7,1}} + {x_{4,2}a_{7,2}} + \ldots + {x_{4,7}a_{7,7}}} = 0} \\ {{{x_{5,1}a_{7,1}} + {x_{5,2}a_{7,2}} + \ldots + {x_{5,7}a_{7,7}}} = 0} \\ {{{x_{6,1}a_{7,1}} + {x_{6,2}a_{7,2}} + \ldots + {x_{6,7}a_{7,7}}} = 0} \\ {{{x_{7,1}a_{7,1}} + {x_{7,2}a_{7,2}} + \ldots + {x_{7,7}a_{7,7}}} = k_{7}} \end{matrix}\quad} \right.$

(8) Let A=(A₁ ^(T), A₂ ^(T), . . . , A₇ ^(T)); K=(K₁, K₂, . . . , K₇) from the above (1) to (7), it can be obtained that X×A=K, that is,

$\begin{bmatrix} x_{11} & x_{12} & x_{13} & x_{14} & x_{15} & x_{16} & x_{17} \\ x_{21} & x_{22} & x_{23} & x_{24} & x_{25} & x_{26} & x_{27} \\ x_{31} & x_{32} & x_{33} & x_{34} & x_{35} & x_{36} & x_{37} \\ x_{41} & x_{42} & x_{43} & x_{44} & x_{45} & x_{46} & x_{47} \\ x_{51} & x_{52} & x_{53} & x_{54} & x_{55} & x_{56} & x_{57} \\ x_{61} & x_{62} & x_{63} & x_{64} & x_{65} & x_{66} & x_{67} \\ x_{71} & x_{72} & x_{73} & x_{74} & x_{75} & x_{76} & x_{77} \end{bmatrix} \times {\quad{\begin{bmatrix} a_{11} & a_{21} & a_{31} & a_{41} & x_{51} & x_{61} & x_{71} \\ a_{12} & a_{22} & a_{32} & a_{42} & x_{52} & x_{62} & x_{72} \\ a_{13} & a_{23} & a_{33} & a_{43} & x_{53} & x_{63} & x_{73} \\ a_{14} & a_{24} & a_{34} & a_{44} & x_{54} & x_{64} & x_{74} \\ a_{15} & a_{25} & a_{35} & a_{45} & x_{55} & x_{65} & x_{75} \\ a_{16} & a_{26} & a_{36} & a_{46} & x_{56} & x_{66} & x_{76} \\ a_{17} & a_{27} & a_{37} & a_{47} & x_{57} & x_{67} & x_{77} \end{bmatrix} = {\quad\begin{bmatrix} k_{1} & k_{2} & k_{3} & k_{4} & k_{5} & k_{6} & k_{7} \\ 0 & k_{2} & 0 & k_{4} & k_{5} & 0 & 0 \\ 0 & 0 & k_{3} & 0 & 0 & k_{6} & k_{7} \\ 0 & 0 & 0 & k_{4} & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & k_{5} & 0 & 0 \\ 0 & 0 & 0 & 0 & 0 & k_{6} & 0 \\ 0 & 0 & 0 & 0 & 0 & 0 & k_{7} \end{bmatrix}}}}$

As long as the matrix determinant

${{X} = {{\begin{matrix} x_{11} & x_{12} & \ldots & x_{17} \\ x_{21} & x_{22} & \ldots & x_{27} \\ \vdots & \vdots & \ddots & \vdots \\ x_{71} & x_{72} & \ldots & x_{77} \end{matrix}} \neq 0}},$

then A has a unique solution.

The matrix A calculated and the mapping parameter are broadcasted or multicasted by CC to all the subgroup controllers SC_(i) via public channel, wherein i=1, 2, . . . , 7;

Step 4: after all the subgroup controllers receive the public matrix A and the mapping parameter r, the new vector is calculated through f(•, •) and the mapping parameter r:

For the subgroup controller SC_(i), wherein X_(i)=(X_(i,1), x_(i,2), . . . , x_(i,7)):

x_(i, 1) = f(z_(i, 1), r) x_(i, 2) = f(z_(i, 2), r) … , x_(i, 7) = f(z_(i, 7), r)

Then, k_(i) and t_(j) (j≠i and j=1, . . . , 7) are calculated according to the equations (4) and (5), wherein i=1, 2, . . . , 7;

For example, for V₃, the subgroup controller SC₃ receives the matrix A and the parameter r, and calculates X₃ (X_(3,1), x_(3,2), . . . , x_(3,7)):

x_(3, 1) = f(z_(3, 1), r) x_(3, 2) = f(z_(3, 2), r) … , x_(3, 7) = f(z_(3, 7), r)

Then, according to the equations (4) and (5), SC₃ calculates k₃ and t_(j) (j=1, 2, 4, 5, 6, 7), Wherein t₆=k₆, t₇=k₇, and the other t_(j)=0 (j=1, 2, 4, 5); the subgroup controller SC₃ distributes the calculated k₃ and t_(j) (j=1, 2, 4, 5, 6, 7) to subgroup members through the group key management scheme in the subgroup.

As shown in FIG. 4, a group with hierarchical access control and seven subgroups is established according to the above steps. The hierarchical relationship among subgroups is contained in the confidential vector of each subgroup and the public matrix A.

Embodiment 2

When the relationship between the subgroups is changed, as shown in FIG. 5: V₆ wants to leave the group while V₈ wants to join in the group as a new subgroup of V₂.

Step 1, as show in FIG. 6, SC₆ sends a leaving request to CC, and CC deletes the private vector Z₆ after receiving the request; CC selects a private vector ZεF^(N) randomly, and sends it to the subgroup controller of V₈ via secure channel; after receiving the private vector Z, the subgroup controller of V₈ stores it and keeps secret;

CC reassigns serial numbers for the current subgroup controllers, wherein SC₁ to SC₅ remain unchanged, and the corresponding private vectors are Z₁ to Z₅ respectively; SC₇ is changed into SC₆, while the corresponding private vector is changed into Z₆; the serial number of V₈ is changed into SC₇ while its corresponding private vector is changed into Z₇ correspondingly. At this time, the private vector stored by CC is Z_(i)(i=1, 2, . . . , 7), and the hierarchical relationship of the group is shown in FIG. 7.

The other steps are identical to the steps 2 to 4 of Embodiment 1. It should be noted that: for SC₇, the relationship of each private vector X_(i)(i=1, 2, . . . , 7), the public vector A₇ and the subgroup key k₇ is different from the item (7) of the step 3 of Embodiment 1, and the corresponding relationship after SC₇ is changed is as follows:

For SC₇, V₃ can no longer derive k₇, and k₇ can be derived by V₁, V₂ and V₇, but can not be derived by the other V_(i)(i=4, 5, 6). Each private vector X_(i)(i=1, 2, . . . , 7), the public vector A₇ and the key k₇ have the following relationship:

X ₁ ×A ₇ ^(T) =k ₇

X ₂ ×A ₇ ^(T) =k ₇

X ₃ ×A ₇ ^(T)=0

X ₄ ×A ₇ ^(T)=0

X ₅ ×A ₇ ^(T)=0

X ₆ ×A ₇ ^(T)=0

X ₇ ×A ₇ ^(T) =k ₇

Suppose K₇=(k₇, k₇, 0, 0, 0, 0, k₇)^(T), then it can be written in matrix form: X×A₇ ^(T)=K₇; while it can also be represented by a system of equations as follows:

$\quad\left\{ \begin{matrix} {{{x_{1,1}a_{7,1}} + {x_{1,2}a_{7,2}} + \ldots + {x_{1,7}a_{7,7}}} = k_{7}} \\ {{{x_{2,1}a_{7,1}} + {x_{2,2}a_{7,2}} + \ldots + {x_{2,7}a_{7,7}}} = k_{7}} \\ {{{x_{3,1}a_{7,1}} + {x_{3,2}a_{7,2}} + \ldots + {x_{3,7}a_{7,7}}} = 0} \\ {{{x_{4,1}a_{7,1}} + {x_{4,2}a_{7,2}} + \ldots + {x_{4,7}a_{7,7}}} = 0} \\ {{{x_{5,1}a_{7,1}} + {x_{5,2}a_{7,2}} + \ldots + {x_{5,7}a_{7,7}}} = 0} \\ {{{x_{6,1}a_{7,1}} + {x_{6,2}a_{7,2}} + \ldots + {x_{6,7}a_{7,7}}} = 0} \\ {{{x_{7,1}a_{7,1}} + {x_{7,2}a_{7,2}} + \ldots + {x_{7,7}a_{7,7}}} = k_{7}} \end{matrix} \right.$

The other details are identical to the step 3 of the Embodiment 1.

As shown in FIG. 7, the bulk operation of joining and leaving of groups is done through the above steps, and the new hierarchical relationship is also reflected in A and each X_(i) (i=1, 2, . . . , 7). Joining or leaving separately can be regarded as a special form of the bulk operation. During the joining operation of new groups, the secure channel only exists when the new group sends the private vector to CC, and the other groups (original groups) do not need to resend the private vectors to CC.

Embodiment 3

As shown in FIG. 8, a group communication system with hierarchical access control includes a central controller CC, subgroups V_(i), subgroup controllers SC_(i), wherein the central controller CC and the subgroup controllers SC_(i) are connected via internet, wherein i=1, 2, . . . , 5.

The group hierarchical access structure is shown in FIG. 9. All the higher level nodes can derive the keys of its direct or indirect descendant nodes, while the lower level nodes can not derive the keys of it ancestor nodes. The subgroups without direct nor indirect ancestor-descendant relationship can not know the subgroup key of each other. The key of one node can not be derived by the other node if they are brother nodes.

As shown in FIG. 10, the system selects the finite field F, and all computations are performed over the finite field F; meanwhile, a pseudo-random number generator is selected to be used as f(•,•); for the same initialization input (seed), the pseudo-random number generator should have the same output sequence; at initialization, let m=2.

Step 1, when the subgroup V_(i) wants to join the group, CC selects two private vectors Z_(i)=(z_(i,1),z_(i,2)) and Y_(i)=(y_(i,1),y_(i,2)) for each subgroup V_(i); sends them to the corresponding subgroup controller via secure channel, and all the subgroup controllers receive the private vectors Z_(i) and Y_(i), store them and keep secret; a serial number SC_(i) for the subgroup controller of the subgroup V_(i) is assigned by CC and broadcasted and multicasted to all the subgroup controllers via public channel, wherein i=1, . . . , 5;

Step 2, the central controller CC selects a random number r over the finte field F to be used as the mapping parameter, and maps all the private vectors Z_(i) and Y_(i) respectively into new vectors X_(i)=(x_(i,1), . . . , x_(i,5)) and W_(i)=(w_(i,1)w_(i,2)), wherein i=1, 2, . . . , 5:

x _(1,1) =f(z _(1,1) ,r)x _(2,1) =f(z _(2,1) ,r)x _(3,1) =f(z _(3,1) ,r)x _(4,1) =f(z _(4,1) ,r)x _(5,1) =f(z _(5,1) ,r)

x _(1,2) =f(z _(1,2) ,r),x _(2,2) =f(z _(2,2) ,r),x _(3,3) =f(z _(3,2) ,r),x _(4,4) =f(z _(4,2) ,r),x _(5,5) =f(z _(5,2) ,r);

w _(1,1) =f(y _(1,1) ,r)w _(2,1) =f(y _(2,1) ,r)w _(3,1) =f(y _(3,1) ,r)w _(4,1) =f(y _(4,1) ,r)w _(5,1) =f(y _(5,1) ,r)

w _(1,2) =f(y _(1,2) ,r),w _(2,2) =f(y _(2,2) ,r),w _(3,2) =f(y _(3,2) ,r),w _(4,2) =f(y _(4,2) ,r),w _(5,2) =f(y _(5,2) ,r)

Then, the central controller CC obtains a new set of n-dimensional vectors X_(i) and a new set of two-dimensional vectors W_(i), wherein i=1, . . . , 5, and X_(i) and W_(i) are called confidential vectors:

X ₁=(x _(1,1) ,x _(1,2),0,0,0)

X ₂=(x _(2,1) ,x _(2,2),0,0,0)

X ₃=(x _(3,1),0,x _(3,3),0,0)

X ₄=(x _(4,1),0,0,x _(4,4),0)

X ₅=(x _(5,1),0,0,0,x _(5,5))

W ₁=(w _(1,1) ,w _(1,2))

W ₂=(w _(2,1) ,w _(2,2))

W ₃=(w _(3,1),w_(3,2))

W ₄=(w _(4,1) ,w _(4,2))

W ₅=(w _(5,1) ,w _(5,2))

The central controller CC judges whether X₁, X₂, . . . , X₅ are linearly dependent, and if they are linearly independent, then proceed to the step 3; or else, return to step 2; (because r is a random number, it is very easy to obtain a set of vectors X₁, X₂, . . . , X₅ which are linearly independent);

Step 3, suppose the private vector of the subgroup V_(i) is A_(i)=(a_(i,1), a_(i,2), . . . , a_(i,5)); the central controller CC selects a key randomly in the finite field F for each group controller SC_(i), respectively, k_(1,1), k_(2,2), . . . , k_(5,5), and k_(i)≠0 (i=1, 2, . . . , 5); the central controller CC calculates the public matrix A through a series of systems of equations as follows, wherein i=1, 2, . . . , 5:

(1) for V₁, only V₁ can derive k_(1,1), and the other V_(i) (i=2, 3, . . . , 5) can not derive k_(1,1). The relationship of each X_(i)(i=1, 2, . . . , 5), the public vector A₁ and the key k_(1,1) is as follows:

X ₁ ×A ₁ ^(T) =k _(1,1)

X ₂ ×A ₁ ^(T)=0

X ₃ ×A ₁ ^(T)=0

X ₄ ×A ₁ ^(T)=0

X ₅ ×A ₁ ^(T)=0

suppose X=(X₁, X₂, . . . , X₃), K₁=(k_(1,1), 0, 0, 0, 0)^(T), then it can be written in matrix form: X×A₁ ^(T)=K₁, while it can also be represented by a system of equations as follows:

$\quad\left\{ \begin{matrix} {{{x_{1,1}a_{1,1}} + {x_{1,2}a_{1,2}} + 0 + 0 + 0} = k_{1,1}} \\ {{{x_{2,1}a_{1,1}} + {x_{2,2}a_{1,2}} + 0 + 0 + 0} = 0} \\ {{{x_{3,1}a_{1,1}} + 0 + {x_{3,3}a_{1,3}} + 0 + 0} = 0} \\ {{{x_{4,1}a_{1,1}} + 0 + 0 + {x_{4,4}a_{1,4}} + 0} = 0} \\ {{{x_{5,1}a_{1,1}} + 0 + 0 + 0 + {x_{5,5}a_{1,5}}} = 0} \end{matrix} \right.$

(2) for V₂, k_(2,2) can be derived by V₁ and V₂, wherein V₁ will derive k_(2,2) via an indirect method, and the other V_(i)(i=3, 4, . . . , 5) can not derive k_(2,2). Each private vector X_(i)(i=1, 2, . . . , 5), the public vector A₂ and the key k_(2,2) have the following relationship:

X ₁ ×A ₂ ^(T) =k _(1,2)

X ₂ ×A ₂ ^(T) =k _(2,2)

X ₃ ×A ₂ ^(T)=0

X ₄ ×A ₂ ^(T)=0

X ₅ ×A ₂ ^(T)=0

wherein, k_(1,2)=(k_(2,2)−w_(1,1)k_(1,1))w_(1,2) ⁻¹

suppose K₂=(k_(1,2), k_(2,2), 0, 0, 0)^(T), then it can be written in matrix form as: X×A₂ ^(T)=K₂, while it can also be represented by a system of equations as follows:

$\quad\left\{ \begin{matrix} {{{x_{1,1}a_{2,1}} + {x_{1,2}a_{2,2}} + 0 + 0 + 0} = k_{1,2}} \\ {{{x_{2,1}a_{2,1}} + {x_{2,2}a_{2,2}} + 0 + 0 + 0} = k_{2,2}} \\ {{{x_{3,1}a_{2,1}} + 0 + {x_{3,3}a_{2,3}} + 0 + 0} = 0} \\ {{{x_{4,1}a_{2,1}} + 0 + 0 + {x_{4,4}a_{2,4}} + 0} = 0} \\ {{{x_{5,1}a_{2,1}} + 0 + 0 + 0 + {x_{5,5}a_{2,5}}} = 0} \end{matrix} \right.$

wherein, k_(1,2)=(k_(2,2)−w_(1,1)k_(1,1))w_(1,2) ⁻¹

(3) for V₃, only V₁ and V₃ can derive k_(3,3), wherein V₁ will derive k_(3,3) via an indirect method; the other V_(i)(i=2, 4, 5) can not derive k_(3,3). Each private vector X_(i) (i=1, 2, . . . , 5), the public vector A₃ and the key k_(3,3) have the following relationship:

X ₁ ×A ₃ ^(T) =k _(1,3)

X ₂ ×A ₃ ^(T)=0

X ₃ ×A ₃ ^(T) =k _(3,3)

X ₄ ×A ₃ ^(T)=0

X ₅ ×A ₃ ^(T)=0

k _(1,3)=(k _(3,3) −w _(1,1) k _(1,1))w _(1,2) ⁻¹

suppose K₃=(k_(1,3), 0, k_(3,3), 0, 0)^(T), then it can be written in matrix form as: X×A₃ ^(T)=K₃; while it can also be represented by a system of equations as follows:

$\left\{ {{\begin{matrix} {{{x_{1,1}a_{3,1}} + {x_{1,2}a_{3,2}} + 0 + 0 + 0} = k_{1,3}} \\ {{{x_{2,1}a_{3,1}} + {x_{2,2}a_{3,2}} + 0 + 0 + 0} = 0} \\ {{{x_{3,1}a_{3,1}} + 0 + {x_{3,3}a_{3,3}} + 0 + 0} = k_{3,3}} \\ {{{x_{4,1}a_{3,1}} + 0 + 0 + {x_{4,4}a_{3,4}} + 0} = 0} \\ {{{x_{5,1}a_{3,1}} + 0 + 0 + 0 + {x_{5,5}a_{3,5}}} = 0} \end{matrix}k_{1,3}} = {\left( {k_{3,3} - {w_{1,1}k_{1,1}}} \right)w_{1,2}^{- 1}}} \right.$

(4) for V₄, k_(4,4) can be derived by V₁, V₂ and V₄, wherein V₁ and V₂ will derive k_(4,4) via an indirect method; the other V_(i)(i=3, 5) can not derive k_(4,4). Each confidential vector X_(i)(i=1, 2, . . . , 5), the public vector A₄ and the key k_(4,4) have the following relationship:

X ₁ ×A ₄ ^(T) =k _(1,4)

X ₂ ×A ₄ ^(T) =k _(2,4)

X ₃ ×A ₄ ^(T)=0

X ₄ ×A ₄ ^(T) =k _(4,4)

X ₅ ×A ₄ ^(T)=0

k _(1,4)=(k _(4,4) −w _(1,1) k _(1,1))w _(1,2) ⁻¹

k _(2,4)=(k _(4,4) −w _(2,1) k _(2,2))w _(2,2) ⁻¹

suppose K₄=(k_(1,4), k_(2,4), 0, k_(4,4), 0, 0, 0)^(T), then it can be written in matrix form as X×A₄ ^(T)=K₄; while it can also be represented by a system of equations as follows:

$\left\{ {{\begin{matrix} {{{x_{1,1}a_{4,1}} + {x_{1,2}a_{4,2}} + 0 + 0 + 0} = k_{1,4}} \\ {{{x_{2,1}a_{4,1}} + {x_{2,2}a_{4,2}} + 0 + 0 + 0} = k_{2,4}} \\ {{{x_{3,1}a_{4,1}} + 0 + {x_{3,3}a_{4,3}} + 0 + 0} = 0} \\ {{{x_{4,1}a_{4,1}} + 0 + 0 + {x_{4,4}a_{4,4}} + 0} = k_{4,4}} \\ {{{x_{5,1}a_{4,1}} + 0 + 0 + 0 + {x_{5,5}a_{4,5}}} = 0} \end{matrix}k_{1,4}} = {{\left( {k_{4,4} - {w_{1,1}k_{1,1}}} \right)w_{1,2}^{- 1}k_{2,4}} = {\left( {k_{4,4} - {w_{2,1}k_{2,2}}} \right)w_{2,2}^{- 1}}}} \right.$

(5) for V₅, k_(5,5) can be derived by V₁, V₃ and V₅, wherein V₁ and V₃ will derive k_(5,5) via an indirect method; other V_(i)(i=2, 4) can not derive k_(5,5). Each confidential vector X_(i)(i=1, 2, . . . , 5), the public vector A₅ and the key k_(5,5) have the following relationship:

X ₁ ×A ₅ ^(T) =k _(1,5)

X ₂ ×A ₄ ^(T)=0

X ₃ ×A ₅ ^(T) =k _(3,5)

X ₄×A₅ ^(T)=0

X ₅ ×A ₅ ^(T) =k _(5,5)

k _(1,5)=(k _(5,5) −w _(1,1) k _(1,1))w _(1,2) ⁻¹

k _(3,5)=(k _(5,5) −w _(3,1) k _(3,3))w _(3,2) ⁻¹

suppose K₅=(k_(1,5), 0, k_(3,5), 0, k_(5,5))^(T), then it can be written in matrix form as X×A₅ ^(T)=K₅; while it can also be represented by a system of equations as follows:

$\begin{matrix} \left\{ {{{\begin{matrix} {{{x_{1,1}a_{5,1}} + {x_{1,2}a_{5,2}} + 0 + 0 + 0} = k_{1,5}} \\ {{{x_{2,1}a_{5,1}} + {x_{2,2}a_{5,2}} + 0 + 0 + 0} = 0} \\ {{{x_{3,1}a_{5,1}} + 0 + {x_{3,3}a_{5,3}} + 0 + 0} = k_{3,5}} \\ {{{x_{4,1}a_{5,1}} + 0 + 0 + {x_{4,4}a_{5,4}} + 0} = 0} \\ {{{x_{5,1}a_{5,1}} + 0 + 0 + 0 + {x_{5,5}a_{5,5}}} = k_{5,5}} \end{matrix}k_{1,5}} = {{\left( {k_{5,5} - {w_{1,1}k_{1,1}}} \right)w_{1,2}^{- 1}k_{3,5}} = {{\left( {k_{5,5} - {w_{3,1}k_{3,3}}} \right)w_{3,2}^{- 1}{Let}\mspace{14mu} A} = \left( {A_{1}^{T},A_{2}^{T},\ldots \mspace{14mu},A_{7}^{T}} \right)}}};{K = \left( {K_{1},K_{2},\ldots \mspace{14mu},K_{7}} \right)}} \right. & (6) \end{matrix}$

It can be obtained that X×A=K from the above (1) to (5), that is:

$\begin{bmatrix} x_{11} & x_{12} & 0 & 0 & 0 \\ x_{21} & x_{22} & 0 & 0 & 0 \\ x_{31} & 0 & x_{33} & 0 & 0 \\ x_{41} & 0 & 0 & x_{44} & 0 \\ x_{51} & 0 & 0 & 0 & x_{55} \end{bmatrix}{\quad{\begin{bmatrix} a_{11} & a_{21} & a_{31} & a_{41} & a_{51} \\ a_{12} & a_{22} & a_{32} & a_{42} & a_{52} \\ a_{13} & a_{23} & a_{33} & a_{43} & a_{53} \\ a_{14} & a_{24} & a_{34} & a_{44} & a_{54} \\ a_{15} & a_{25} & a_{35} & a_{45} & a_{55} \end{bmatrix} = \begin{bmatrix} k_{11} & k_{12} & k_{13} & k_{14} & k_{15} \\ 0 & k_{22} & 0 & k_{24} & 0 \\ 0 & 0 & k_{33} & 0 & k_{35} \\ 0 & 0 & 0 & k_{44} & 0 \\ 0 & 0 & 0 & 0 & k_{55} \end{bmatrix}}}$

As long as the determinant |X|≠0, then A has a unique solution.

The matrix A calculated and the mapping parameter are broadcasted or multicasted by CC to all the subgroup controllers SC_(i) via public channel, wherein i=1, 2, . . . , 5;

Step 4, after all the subgroup controllers receive the public matrix A and the mapping parameter r, the new vector is calculated through f(•,•) and the mapping parameter r:

For any subgroup V_(i), its subgroup controller is SC_(i), wherein X_(i)=(x_(i,1), x_(i,2), . . . , x_(i,5)), x_(i,1)=f(z_(i,1),r), x_(i,i)=f(z_(i,2),r), and the other x_(i,j)=0 (j≠1, j≠i and j=1, . . . , 5); W_(i)=(w_(i,1),w_(i,2)), w_(i,1)=f(y_(i,1),r), w_(i,2)=f(y_(i,2),r). All the k_(i,j)(j=1, . . . , 5), that is, k_(i,1), k_(i,2), k_(i,3), k_(i,4), k_(i,5), are calculated according to the equation (9). If j=i, then k_(i,j)=k_(i,i), that is the key of the subgroup. If j≠i and k_(i,j)≠0, then the group key k_(j,j) of the subgroup V_(i) is calculated according to the equation (10). For example, for V₃, X₃=(x_(3,1), 0, x_(3,3), 0, 0) and W₃=(w_(3,1),w_(3,2)) are calculated after SC₃ receives A and r:

x _(3,1) =f(z _(3,1) ,r)w _(3,1) =f(y _(3,1) ,r)

x _(3,3) =f(z _(3,2) ,r),w _(3,2) =f(y _(3,2) ,r)

k_(3,1)-k_(3,5) are calculated according to the equation (9), wherein k_(3,3)≠0 and k_(3,5)≠0. k_(3,3) is the group key of the subgroup V₃; k_(3,5) is the indirect key for SC₃ to calculate the group key k_(5,5) of the subgroup V₅. According to the equation (10), k_(5,5)=w_(3,1)k_(3,3)+w_(3,2)k_(3,5).

The calculated k_(3,3) and k_(5,5) are sent by SC₃ to group members through the key management scheme in the group.

As shown in FIG. 11, a group with hierarchical access control and seven subgroups is established through the above steps. The hierarchical relationship between subgroups is contained in the public vector A and the private vectors of each subgroup.

Embodiment 4

When the relationship between the subgroups is changed, as shown in FIG. 12: V₅ would like to leave the group, and V₆ would like to join in the group as a new subgroup of V₂.

Step 1, as shown in FIG. 13, SC₅ sends a request for leaving to CC, and then CC deletes the private vectors Z₅ and W₅ of V₅ after receiving the request for leaving; then CC selects a m-dimensional private vector Z₆ and a two-dimensional private vector Y₆ randomly over the finite field F and sends them via secure channel to the subgroup controller of V₆ which stores them and keeps secret after receiving Z₆ and Y₆.

The central controller CC reassigns the serial numbers for the current subgroup controllers, wherein SC₁-SC₄ remain unchanged, and the corresponding m-dimensional private vectors and the two-dimensional private vectors are Z₁-Z₄ and Y₁-Y₄ respectively. The serial number of the subgroup controller of the new joining subgroup V₆ is SC₅, and the corresponding private vectors are Zs and Y₅. At this time, the private vectors stored by CC are Z_(i) and Y_(i) (i=1, 2, . . . , 5), and the hierarchical relationship of the group is shown in FIG. 12.

The other steps are identical to the steps 2 to 4 of Embodiment 1. It should be noted that for SC₅, the relationship of each private vector X_(i), W_(i)(i=1, 2, . . . , 5), the public vector A₅ and the subgroup key k_(5,5) is different from the item (5) of the step 3 of the Embodiment 1, the other items remain the same and the corresponding relationship after SC₅ is changed is as follows:

For SC₅, V₅ can derive k_(5,5) directly, while V₁, V₂ and V₇ can derive k_(5,5) indirectly, but V₃ and V₄ can not derive k_(5,5). Each private vector X_(i)(i=1, 2, . . . , 5), the public vector A₅ and the key k_(5,5) have the following relationship:

X ₁ ×A ₅ ^(T) =k _(1,5)

X ₂ ×A ₅ ^(T) =k _(2,5)

X ₃ ×A ₅ ^(T)=0

X ₄ ×A ₅ ^(T)=0

X ₅ ×A ₅ ^(T) =k _(5,5)

k _(1,5)=(k _(5,5) −w _(1,1) k _(1,1))w _(1,2) ⁻¹

k _(2,5)=(k _(5,5) −w _(2,1) k _(2,2))w _(2,2) ⁻¹

Suppose K₅=(k_(1,5), k_(2,5), 0, 0, k_(5,5))^(T), then it can be written in matrix form as X×A₅ ^(T)=K₅; while it can also be represented by a system of equations as follows:

$\left\{ {{\begin{matrix} {{{x_{1,1}a_{5,1}} + {x_{1,2}a_{5,2}} + 0 + 0 + 0} = k_{1,5}} \\ {{{x_{2,1}a_{5,1}} + {x_{2,2}a_{5,2}} + 0 + 0 + 0} = k_{2,5}} \\ {{{x_{3,1}a_{5,1}} + 0 + {x_{3,3}a_{5,3}} + 0 + 0} = 0} \\ {{{x_{4,1}a_{5,1}} + 0 + 0 + {x_{4,4}a_{5,4}} + 0} = 0} \\ {{{x_{5,1}a_{5,1}} + 0 + 0 + 0 + {x_{5,5}a_{5,5}}} = k_{5,5}} \end{matrix}k_{1,5}} = {{\left( {k_{5,5} - {w_{1,1}k_{1,1}}} \right)w_{1,2}^{- 1}k_{2,5}} = {\left( {k_{5,5} - {w_{2,1}k_{2,2}}} \right)w_{2,2}^{- 1}}}} \right.$

The other details are identical to that of the step 3 of the Embodiment 3.

As shown in FIG. 14, the bulk operation of joining and leaving of groups is done through the above steps, and the new hierarchical relationship is also reflected in the public vector A and each confidential vector X_(i) (i=1, 2, . . . , 5). Joining or leaving separately can be regarded as a special form of the bulk operation. During the joining operation of new groups, the secure channel only exists when the new group sends the private vector to CC, and the other groups (original groups) do not need to resend the private vectors to CC.

It should be emphasized that the above-described embodiments can be combined freely. Many variations and modifications, replacements, combinations and simplifications may be made to the above-described embodiment(s) of the invention without departing substantially from the spirit and principles of the invention. All such modifications and variations are intended to be included herein within the scope of this disclosure and the present invention and protected by the following claims. 

1. A hierarchical group key management approach based on linear geometry, comprising the following steps: step 1: a central controller selects a mapping f and a finite field F for use by a group, and all computations in the group are performed over the finite field F; a constant N is determined by the central controller to be used as a upper limit of the number of subgroups; the central controller sends the finite field F, the constant N and the mapping f to all subgroup controllers; suppose the group has n subgroups, the central controller assigns a serial number for each subgroup and sends each serial number to each subgroup controller; meanwhile, the central controller selects a N-dimensional private vector randomly for each subgroup, and sends each N-dimensional private vector to each subgroup controller correspondingly via secure channel; the subgroup controllers receive and store the N-dimensional private vectors from the central controller and keep secret, wherein N and n are positive integers, and n≦N; step 2: the central controller selects a mapping parameter r in the finite field F, and maps the private vectors of all the subgroup controllers into a new set of vectors called confidential vectors in a vector space by using the mapping f according to the mapping parameter r; if the new set of vectors is linearly dependent, then the mapping parameter is reselected to perform remapping, or return to the step 1 to allow each subgroup controller to reselect a private vector, until the new set of vectors is linearly independent; step 3: the central controller selects a subgroup key in the finite field F for each subgroup; the central controller constructs n linear systems of equations according to the hierarchy relationship of the subgroups by using the confidential vectors and the subgroup keys, and calculates the unique solutions of the linear systems of equations which are called public vectors; the confidential vectors and the public vectors are subject to the following regulations: (1) the confidential vectors of lower level nodes are orthogonal to the public vectors of higher level nodes, and the inner product is zero; (2) for all the nodes, the inner product of the confidential vector and the public vector of a current node itself is the group key of the current node; (3) when the higher level node is a parent node or ancestor node of the current node, the inner product of the confidential vector of the higher level node and the public vector of the current node is the group key of the current node; the inner product of the confidential vector of the higher level node and the public vector of a descendant node is the group key of the descendant node; (4) for nodes without direct nor indirect ancestor-descendant relationship with respect to each other, the inner product of the confidential vector of one node and the public vector of the other node is zero; (5) the key of one node can not be derived by the other node between brother nodes, and the inner product of the confidential vector of one node and the public vector of the other node is zero; n sets of public vectors form a public matrix, and the public matrix and the mapping parameter r are broadcasted or multicasted by the central controller to all the subgroup controllers via open channel; step 4: after receiving the public matrix and the mapping parameter, each subgroup controller maps the private vector of its own to a new vector in a vector space according to the parameter, and solves a confidential vector of its own, then a set of key vectors is obtained by computation of the confidential vector and the public matrix; the subgroup controller obtains its group key and the group keys of descendant subgroups through the key vector calculated by itself, and the descendant subgroups can not calculate the group keys of its parent group nor ancestor groups; the subgroup controller distributes the group keys calculated to subgroup members.
 2. The hierarchical group key management approach based on linear geometry of claim 1, wherein the step 1 is implemented by the following: the central controller determines a finite field F, a constant N and a mapping f, and sends the finite field F, the constant N and the mapping f to all the subgroup controllers; the central controller assigns a serial number SC_(i) to each subgroup controller, and sends the serial number SC_(i) to each subgroup controller via broadcasting or multicasting; the central controller selects a N-dimensional private vector Z_(i)=(z_(i,1), z_(i,2), . . . , z_(i,N)) randomly for each subgroup V_(i) and sends the private vector to the corresponding subgroup controller SC_(i) via secure channel; each subgroup controller SC_(i) receives and stores the N-dimensional private vector Z_(i)=(z_(i,1), z_(i,2), . . . , z_(i,N)) and keeps secret; the step 2 is implemented by the following: the central controller selects a mapping parameter r in the finite field F, and maps the private vectors Z_(i)=(z_(i,1), z_(i,2), . . . , z_(i,N)) of all the subgroups into a new set of vectors called confidential vectors by using the mapping f; for the subgroup controller SC_(i): x_(i, 1) = f(z_(i, 1), r) x_(i, 2) = f(z_(i, 2), r) … , x_(i, n) = f(z_(i, n), r) then, the central controller obtains a new set of vectors over the finite field F: X₁ = (x_(1, 1), x_(1, 2), … , x_(1, n)), X₂ = (x_(2, 1), x_(2, 2), … , x_(2, n)), … , X_(n) = (x_(n, 1), x_(n, 2), … , x_(n, n)) the central controller judges whether X₁, X₂, . . . , X_(n) are linearly dependent, and if they are linearly dependent, then proceed to the step 2, or return to the step 1 to allow the subgroup controller to reselect a private vector until the new set of vectors are linearly independent; or else proceed to step 3; the step 3 is implemented by the following: the central controller selects a random number for each subgroup in the finite field F to be used as a key of the subgroup, and suppose the selected random numbers are k₁, k₂, . . . , k_(n) wherein k_(i)≠0; for any subgroup V_(i), suppose P(i) represents a set of all ancestor nodes of the subgroup V_(i) and the vector A_(i)=(a_(i,1), a_(i,2), . . . , a_(i,n)) is an unknown parameter, then the public vector A_(i) and the confidential vector X_(j) of each subgroup have the following relationship: $\begin{matrix} {{X_{j} \times A_{i}^{T}} = \left\{ \begin{matrix} {k_{i},} & {{{if}\mspace{14mu} j} = {{i\mspace{14mu} {or}\mspace{14mu} V_{j}} \in {P(i)}}} \\ {0,} & {V_{j} \notin {{{P(i)}\mspace{14mu} {and}\mspace{14mu} j} \neq i}} \end{matrix} \right.} & (1) \end{matrix}$ wherein, i=1, . . . , n and j=1, . . . , n; suppose X=(X₁, X₂, . . . , X_(n))^(T), K_(i)=(c_(i,1), c_(i,2), . . . c_(i,n))^(T), $c_{i,j} = \left\{ \begin{matrix} {k_{i},} & {{{if}\mspace{14mu} j} = {{i\mspace{14mu} {or}\mspace{14mu} V_{j}} \in {P(i)}}} \\ {0,} & {{V_{j} \notin {{{P(i)}\mspace{14mu} {and}\mspace{14mu} j} \neq i}},} \end{matrix} \right.$  then the equation (1) is converted into: X×A _(i) ^(T) =K _(i)  (2) let A=(A₁ ^(T), A₂ ^(T), . . . , A_(n) ^(T)), K=(K₁, K₂, . . . , K_(n)), then for all subgroups V_(i), it is obtained that: X×A=K  (3) the central controller needs to solve the system of equations (3), and the system of equations (3) has a unique solution since the linear independence of X₁, X₂, . . . , X_(n) in the step 2 guarantees the coefficient matrix determinant |X|≠0, and A is the public matrix solved; the public matrix A=(A₁ ^(T), A₂ ^(T), . . . , A_(n) ^(T)) and the mapping parameter r are broadcasted or multicasted by the central controller to all the subgroup controllers via open channel; the step 4 is implemented by the following: each subgroup controller receives the public matrix A=(A₁ ^(T), A₁ ^(T), . . . , A_(n) ^(T)) and the mapping parameter r, and calculates X_(i)=(x_(i,1), x_(i,2), . . . , x_(i,n)) via the mapping f: x_(i, 1) = f(z_(i, 1), r) x_(i, 2) = f(z_(i, 2), r) … , x_(i, n) = f(z_(i, n), r) then calculates: k _(i) =X _(i) ×A _(i) ^(T) =x _(i,1) a _(i,1) +x _(i,2) a _(i,2) + . . . +x _(i,n) a _(i,n)  (4) when j≠i,t _(j) =X _(i) ×A _(j) ^(T) =x _(j,1) a _(i,1) +x _(j,2) a _(i,2) + . . . +x _(j,n) a _(i,n)  (5) wherein i=1, . . . , n; j=1, . . . , n, P(j) represents the set of all ancestor nodes of the subgroup V_(i); if V_(i)εP(j), then t_(j)=k_(j), i.e. the group key of V_(j); or else, t_(j)=0; each subgroup V_(i) calculates its group key or the group keys of its descendant nodes via the equations (4) and (5); the subgroup controller SC_(i) sends the calculated k_(i) and t_(j) (j≠i) to each group member.
 3. The hierarchical group key management approach based on linear geometry of claim 1, wherein the approach further comprises: step 5, when new subgroups join in, the central controller assigns and sends a serial number to each new subgroup controller; meanwhile, the central controller selects a N-dimensional private vector over the finite field F for each new subgroup, and sends the N-dimensional private vector to the corresponding subgroup controller via secure channel; the new subgroup controller receives and stores the N-dimensional private vector of each new group member sent by the central controller and keeps secret; the central controller sends the finite field F, the constant N, and the mapping f to the new subgroup controller; repeat the steps 2 to
 4. 4. The hierarchical group key management approach based on linear geometry of claim 1, wherein the approach further comprises: step 5, when subgroups need to leave, each subgroup member that needs to leave applies to the central group controller for leaving the group; the central group controller deletes the private vectors of the leaving subgroups, and reassigns serial numbers according to the size order of the subscripts of the current subgroup members, and sends the serial numbers to all subgroup controllers by broadcasting or multicasting; repeat the steps 2 to
 4. 5. A hierarchical group key management approach based on linear geometry, comprising the following steps: step 1: the central controller selects a mapping f and a finite field F for use by a group, all computations in the group are performed over the finite field F; a constant m is determined by the central controller; the central controller sends the finite field F, the constant m and the mapping f to all subgroup controllers; suppose the group has n subgroups, the central controller assigns a serial number for each subgroup and sends each serial number to the corresponding subgroup controller; meanwhile, the central controller selects a m-dimensional private vector and a two-dimensional private vector randomly for each subgroup, and sends the m-dimensional private vector and the two-dimensional private vector to each subgroup controller correspondingly via secure channel; the subgroup controllers receive and store the m-dimensional private vectors and the two-dimensional private vectors and keep secret, wherein m and n are positive integers, and 2≦m≦n; step 2: the central controller selects a mapping parameter r in the finite field F, and maps the two-dimensional private vectors of all the subgroup controllers into a new set of vectors by using the mapping f according to the mapping parameter r, and maps the m-dimensional private vectors of all the subgroup controllers into a new set of vectors by using the mapping f according to the mapping parameter r; if the new set of vectors is linearly dependent, then the mapping parameter is reselected to perform remapping, or return to the step 1 to allow each subgroup controller to reselect a private vector, until the new set of vectors is linearly independent; these two new sets of subgroups are called confidential vectors; step 3: the central controller selects a subgroup key in the finite field F for each subgroup; then the central controller constructs n linear systems of equations according to the hierarchy relationship of the subgroups by using the confidential vectors and the subgroup keys, and calculates the unique solutions of the linear systems of equations which are called public vectors; the confidential vectors and the public vectors are subject to the following regulations: (1) for all the nodes, the inner product of the m-dimensional confidential vector and the public vector of a current node itself is the group key of the current node; (2) the m-dimensional confidential vectors of lower level nodes are orthogonal to the public vectors of higher level nodes, and the inner product is zero; (3) if the higher level node is a parent node or ancestor node of the current node, the inner product of the m-dimensional confidential vector of the higher level node and the public vector of the current node is the indirect key; the higher level node further calculates the key of the descendant node via the indirect key and the two-dimensional confidential vector of the higher level node itself; (4) for nodes without direct nor indirect ancestor-descendant relationship with respect to each other, the inner product of the m-dimensional confidential vector of one node and the public vector of the other node is zero; (5) the key of one node can not be derived by the other node between brother nodes, and the inner product of the m-dimensional confidential vector of one node and the public vector of the other is zero; n sets of public vectors form a public matrix, and the public matrix and the mapping parameter r are broadcasted or multicasted by the central controller to all the subgroup controllers via open channel; step 4: after receiving the public matrix and the mapping parameter, each subgroup controller maps two private vectors of its own to two new vectors called confidential vectors in a vector space according to the mapping parameter, and then a set of key vectors is obtained by linear transformation of the m-dimensional confidential vector and the public matrix; the subgroup controller obtains its group key through the key vector calculated by itself, and calculates the group keys of descendant subgroups through the two-dimensional confidential vector and the group key of its own, while the descendant subgroups can not calculate the group keys of its parent group and ancestor groups; the subgroup controller distributes the calculated group keys to group members.
 6. The hierarchical group key management approach based on linear geometry of claim 5, wherein, the step 1 is implemented by the following: the central controller determines a finite field F, a constant m and a mapping f, and sends the finite field F, the constant m and the mapping f to all the subgroup controllers SC_(i); the central controller selects a m-dimensional private vector Z_(i)=(z_(i,1)z_(i,2), . . . , z_(i,m)) and a two-dimensional private vector Y_(i)=(y_(i,1),y_(i,2)) over the finite filed F for each subgroup V_(i), and sends Z_(i) and Y_(i) to the corresponding subgroup controller SC_(i) via secure channel; the subgroup controller SC_(i) receives and stores the private vectors Z_(i) and Y_(i) and keeps secret; the central controller assigns a serial number SC_(i) for each subgroup controller, and sends the serial number SC_(i) to all the subgroup controllers by broadcasting or multicasting, wherein i=1, . . . , n; the step 2 is implemented by the following: the central controller selects a mapping parameter r in the finite field F randomly, and maps the private vectors Z_(i) of all the subgroups into a new set of vectors X_(i) by using the mapping f, and maps the private vectors Y_(i) of all the subgroups into a new set of vectors W_(i), wherein X_(i) and W_(i) are called confidential vectors; $\begin{matrix} {{{{for}\mspace{14mu} {all}\mspace{14mu} {subgroups}\mspace{14mu} {SC}_{i}},{i = 1},\ldots \;,n,{{{the}\mspace{14mu} {vector}\mspace{14mu} W_{i}} = {{\left( {w_{i,1},w_{i,2}} \right):w_{i\; 1}} = {f\left( {y_{i,1},r} \right)}}}}{w_{i\; 2} = {f\left( {y_{i,2},r} \right)}}} & (1) \\ {{{{{{for}\mspace{14mu} i} = 1},\ldots \;,m,{X_{i} = {{\left( {x_{i,1},\ldots \;,x_{i,m},0,\ldots \;,0} \right):x_{i,1}} = {f\left( {z_{i,1},r} \right)}}}}\ldots x_{i,m} = {f\left( {z_{i,m},r} \right)}}{{{{let}\mspace{14mu} x_{i,{m + 1}}} = {\ldots = {x_{i,n} = 0}}};}} & (2) \\ {{{{{{for}\mspace{14mu} i} = {m + 1}},\ldots \;,n,{X_{i} = \left( {x_{i,1},x_{i,2},\ldots \;,x_{i,{m - 1}},{0\ldots}\;,0_{x_{i,i}},0,\ldots \;,0} \right)}}{x_{i,1} = {f\left( {z_{i,1},r} \right)}}\ldots {x_{i,{m - 1}} = {f\left( {z_{i,{m - 1}},r} \right)}}x_{i,i} = {f\left( {z_{i,m},r} \right)}}{{{{let}\mspace{14mu} x_{i,m}} = {\ldots = {x_{i,{i - 1}} = 0}}},{{x_{i,{i + 1}} = {\ldots = {x_{i,n} = 0}}};}}} & (3) \end{matrix}$ then the central controller obtains a set of n-dimensional vectors consisting of X_(i) over the finite field F: X₁ = (x_(1, 1), x_(1, 2), … , x_(1, n)) X₂ = (x_(2, 1), x_(2, 2), … , x_(2, n)) …  X_(n) = (x_(n, 1), x_(n, 2), … , x_(n, n)) the central controller judges whether X₁, X₂, . . . , X_(n) are linearly dependent, and if they are linearly dependent, then proceed to the step 2 to reselect the mapping parameter and remapping, or return to the step 1 to allow the subgroup controller to reselect a private vector until the new set of vectors are linearly independent; or else proceed to step 3; the step 3 is implemented by the following: the central controller selects a group key k_(i,i), i=1, . . . , n, for each subgroup V_(i); for any subgroup controller SC_(i), i=1, . . . , n, suppose its public vector A_(i)=(a_(i,1), a_(i,2), . . . a_(i,n)) is an unknown parameter, C(V_(i)) is used to represent the set of all descendant groups of the subgroup controller SC_(i), then the public vector A_(i) and the confidential vector X_(i) of each subgroup have the following relationship: X _(i) ×A _(i) ^(T) =k _(i,i) suppose V_(j)εC(V_(i)), i.e. V_(j)(j=1, . . . , n) is the direct or indirect descendant group of V_(i) and j≠i, then A_(j), X_(i), W_(i) and X_(j) have the following relationship: $\begin{matrix} \left\{ \begin{matrix} {{X_{j} \times A_{j}^{T}} = k_{j,j}} \\ {{X_{i} \times A_{j}^{T}} = k_{i,j}} \\ {{W_{i} \times \left( {k_{i,i},k_{i,j}} \right)^{T}} = k_{j,j}} \end{matrix} \right. & (6) \end{matrix}$ it is derived from the equations (6) that: $\begin{matrix} {{X_{i} \times A_{j}^{T}} = {k_{i,j} = \left\{ \begin{matrix} {k_{i,i},} & {j = i} \\ {{\left( {k_{j,j} - {w_{i,1}k_{i,i}}} \right)w_{i,2}^{- 1}},} & {{j \neq {i\bigcap V_{j}}} \in {C\left( V_{i} \right)}} \\ {0,} & {{j \neq {i\bigcap V_{j}}} \notin {C\left( V_{i} \right)}} \end{matrix} \right.}} & (7) \end{matrix}$ wherein, i=1, . . . , n, j=1, . . . , n; suppose X=(X₁, X₂, . . . , X_(n)), K_(i)=(k_(i,1), k_(i,2), . . . , k_(i,n))^(T) then the equation (7) is transformed into: X×A ^(T) =K _(i) let A=(A₁ ^(T), A₂ ^(T), . . . , A_(n) ^(T)), K=(K₁, K₂, . . . , K_(n)), and for all V_(i), then: X×A=K  (8) the equation (8) is written in the form of a system of equations: ${\begin{bmatrix} x_{1,1} & x_{1,2} & \ldots & x_{1,n} \\ x_{2,1} & x_{2,2} & \ldots & x_{2,n} \\ \ldots & \ldots & \ldots & \ldots \\ x_{n,1} & x_{n,2} & \ldots & x_{n,n} \end{bmatrix} \times \begin{bmatrix} a_{1,1} & a_{2,1} & \ldots & a_{n,1} \\ a_{1,2} & a_{2,2} & \ldots & a_{n,2} \\ \ldots & \ldots & \ldots & \ldots \\ a_{1,n} & a_{2,n} & \ldots & a_{n,n} \end{bmatrix}} = \begin{bmatrix} k_{1,1} & k_{1,2} & \ldots & k_{1,n} \\ k_{2,1} & k_{2,2} & \ldots & k_{2,n} \\ \ldots & \ldots & \ldots & \ldots \\ k_{n,1} & k_{n,2} & \ldots & k_{n,n} \end{bmatrix}$ the central controller solves the system of equations (8), and the system of equations (8) has a unique solution: A=X⁻¹K, since the step 3 guarantees the coefficient matrix determinant |X|≠0, and A is the public matrix solved; the mapping parameter r and the matrix A=(A₁ ^(T), A₂ ^(T), . . . , A_(n) ^(T)) are broadcasted or multicasted by the central controller to all the subgroup controllers via open channel; the step 4 is implemented by the following: when each subgroup controller SC_(i) receives the public matrix A=(A₁ ^(T), A₂ ^(T), . . . , A_(n) ^(T)) and the mapping parameter r, each subgroup controller SC_(i) calculates W_(i) and X_(i) according to the serial number i of its own and the mapping f: $\begin{matrix} {{{{{for}\mspace{14mu} {all}\mspace{14mu} {the}\mspace{14mu} i} = 1},\ldots \;,n,{W_{i} = \left( {w_{i,1},w_{i,2}} \right)}}{w_{i,1} = {f\left( {y_{i,1},r} \right)}}{w_{i,2} = {f\left( {y_{i,2},r} \right)}}} & (1) \\ {{{{{{for}\mspace{14mu} i} = 1},\ldots \;,m,{X_{i} = {{\left( {x_{i,1},\ldots \;,x_{i,m},0,\ldots \;,0} \right):x_{i,1}} = {f\left( {z_{i,1},r} \right)}}}}\ldots x_{i,m} = {f\left( {z_{i,m},r} \right)}}{{{{let}\mspace{14mu} x_{i,{m + 1}}} = {\ldots = {x_{i,n} = 0}}};}} & (2) \\ {{{{{{for}\mspace{14mu} i} = {m + 1}},\ldots \;,n,{X_{i} = \left( {x_{i,1},x_{i,2},\ldots \;,x_{i,{m - 1}},{0\ldots}\;,0_{x_{i,i}},0,\ldots \;,0} \right)}}{x_{i,1} = {f\left( {z_{i,1},r} \right)}}\ldots {x_{i,{m - 1}} = {f\left( {z_{i,{m - 1}},r} \right)}}x_{i,i} = {f\left( {z_{i,m},r} \right)}}{{{{let}\mspace{14mu} x_{i,m}} = {\ldots = {x_{i,{i - 1}} = 0}}},{{x_{i,{i + 1}} = {\ldots = {x_{i,n} = 0}}};}}{{{then}\mspace{14mu} {calculate}},{{{for}\mspace{14mu} {all}\mspace{14mu} {the}\mspace{14mu} j} = 1},\ldots \;,n,}} & (3) \\ {k_{i,j} = \left\{ \begin{matrix} {{{{X_{i} \times A_{j}^{T}} = {{x_{i,1}a_{j,1}} + \ldots + {x_{i,m}a_{j,m}}}},}} & {i \leq m} \\ {{{{X_{i} \times A_{j}^{T}} = {{x_{i,1}a_{j,1}} + \ldots + {x_{i,{m - 1}}a_{j,{m - 1}}} + x_{i,i}}},a_{j,i},}} & {i > m} \end{matrix} \right.} & (9) \end{matrix}$ if j=i, k_(i,j)=k_(i,i,) i.e. the key of the subgroup V_(i) itself; if j≠i, the subgroup controller SC_(i) continues to calculate k_(j,j) if k_(i,j)≠0: k _(j,j) =w _(i,1) ×k _(i,i) +w _(i,2) ×k _(i,j)  (10) each subgroup controller SC_(i) calculates the key k_(i,i) and the key k_(j,j) of each descendant subgroup via the equations (9) and (10); the subgroup controller SC_(i) distributes the k_(i,i) and k_(j,j) (j=1, . . . , n and j≠i) calculated to each group member.
 7. The hierarchical group key management approach based on linear geometry of claim 5, wherein the approach further comprises: step 5: when new subgroups join in, the central controller selects a m-dimensional private vector Z_(i)=(z_(i,1), z_(i,2), . . . , z_(i,m)) and a two-dimensional private vector Y_(i)=(y_(i,1),y_(i,2)) for each new subgroup controller over the finite field F, and sends them to the corresponding subgroup controller; the central controller assigns a serial number to each new subgroup controller, and sends the serial number to all subgroup controllers; the new subgroup controller receives and stores the m-dimensional private vector and the two-dimensional private vector sent by the central controller and keeps secret; the central controller sends the finite field F, the constant N, and the mapping f to the new subgroup controllers; repeat the steps 2 to
 4. 8. The hierarchical group key management approach based on linear geometry of claim 5, wherein the approach further comprises: step 5: when subgroups need to leave, each subgroup member that needs to leave applies to the central group controller for leaving the group; the central group controller deletes the private vectors of the leaving subgroups, and reassigns serial numbers according to the size order of the subscripts of the current subgroup members, and sends the serial numbers to all subgroup controllers by broadcasting or multicasting; repeat the steps 2 to
 4. 9. The hierarchical group key management approach based on linear geometry of claim 5, wherein m is
 2. 10. The hierarchical group key management approach based on linear geometry of claim 5, wherein the approach further comprises auto update: if no group member joins in or leaves the group for a preset period of time, then the group controller will update the group key of each subgroup periodically; the group controller reselects a new private vector for each subgroup and sends the new private vector to the corresponding subgroup controller, and then the subgroup controller receives and stores the new private vector and keeps secret; the central controller reselects the mapping parameter and the group key of each subgroup and calculates the public matrix, and then broadcasts or multicasts the public matrix and the mapping parameter to all subgroup controllers via open channel.
 11. The hierarchical group key management approach based on linear geometry of claim 1, wherein the approach further comprises auto update: if no group member joins in or leaves the group for a preset period of time, then the group controller will update the group key of each subgroup periodically; the group controller reselects a new private vector for each subgroup and sends the new private vector to the corresponding subgroup controller, and then the subgroup controller receives and stores the new private vector and keeps secret; the central controller reselects the mapping parameter and the group key of each subgroup and calculates the public matrix, and then broadcasts or multicasts the public matrix and the mapping parameter to all subgroup controllers via open channel. 